Photo Source: Pexel
Synopsis: On October 29, 2026, attackers drained about $6.3 billion from Binance hot wallets across ten or eleven blockchains, depending on the analyst, most of it within roughly 20 minutes. The FBI attributes the theft to North Korea’s TraderTraitor operation, making it the largest crypto theft on record. Binance says it will bear the loss, and roughly $3 billion has been frozen. This article explains how such heists work, who runs them, how the money gets laundered, and what it means for ordinary crypto users.
Late on a Thursday afternoon, New York time, money began leaving Binance. No sirens howled and nobody wore a mask. There were only numbers on a screen, getting smaller. In the first twenty minutes or so, roughly the length of a sitcom episode, billions of dollars slipped out of the world’s biggest crypto exchange. By the end, the money had been spread across ten or eleven blockchains, depending on who is counting.
The popular version of this story stars one brilliant stranger in one very dark room. The real version is far better organised. Behind a theft this size sits the Global Hacking Industry, a trade with planners, coders, con artists and launderers, who take long-term projects very seriously. Analysts estimate the Binance crew spent at least a day and a half getting ready.
What follows is the trail: how the thieves get in, who they work for, where the money goes, and what ordinary crypto holders can do about it. Some of it is startling. Some of it is oddly reassuring.
Table of Contents
Crypto Does Not Live in a Vault
Coins are not files on a hard drive, and they are certainly not gold bars in a cellar. A blockchain is a public ledger that records transactions and balances, visible to anyone with the patience to look. What a thief steals is not the coin but the power to move it. That power lives in keys, and in the software that decides who may use them.
Exchanges keep that power in two kinds of wallet, and the difference matters:
- Hot wallets stay online so withdrawals can happen quickly. Handy, and a bit like keeping the till next to the shop window.
- Cold wallets keep their keys offline, usually on dedicated devices. Slower and sturdier, though still open to human error.
Binance’s loss came from hot wallets. Early on, the exchange said it had found no evidence that private keys leaked. Co-CEO Richard Teng later said the attack did not pass through Binance’s normal approval controls. Think of a bank vault: the key stays safe, but somebody persuades the clerk’s computer to wave the door open.
Twenty Minutes, Ten Blockchains
Binance’s first explanation, published in the small hours of October 30 (UTC), pointed to a possibly compromised DevOps engineer’s laptop. A later update admitted additional points of breach, and Teng said the attack was not the work of one person. The investigation is still open, and Binance has not yet published the full attack sequence.
The main assault was fast. According to Elliptic, funds began leaving at about 20:05 UTC, and a single Ethereum transaction at 20:24 carried roughly $2.53 billion. TRM Labs says most of the haul moved within about twenty minutes, though a second wave hit Avalanche and Polygon after 23:00. Totals differ with the pricing moment: $5.9 billion (Chainalysis), $6.36 billion (TRM Labs) and $6.43 billion (Elliptic).
The days that followed went like this:
- Oct 29: funds leave Binance hot wallets, and withdrawals are paused
- About 40 minutes later: Tether and Circle begin freezing stolen stablecoins
- Oct 31: the FBI names North Korea, and Binance says 90% of the loss is replaced
- Nov 1: withdrawals reopen in phases, Bitcoin first, and Binance reports about 95% replaced
The Cast of Characters
Big thefts are team efforts, complete with job titles and, one suspects, a rota for who brings the biscuits. The roles are roughly these:
- Planners choose the target and the timing.
- Researchers hunt for weak spots in software and routines.
- Malware writers build the tools.
- Social engineers befriend the people who hold the access.
- Launderers turn loot into something spendable.
The work is slow. In the Bybit case, the attackers got into a developer’s machine on February 4, 2025, and took the money on February 21. Seventeen days of quiet, then one very loud afternoon.
Some crews go further and hire themselves in. Chainalysis reports that North Korean operators have placed IT workers inside crypto firms to gain privileged access, which saves a great deal of lock-picking.
Pyongyang’s Most Profitable Department
The FBI attributed the Binance theft to North Korea, naming the activity TraderTraitor. Researchers often file that name under the wider Lazarus umbrella, though threat-actor labels are not tidy organisation charts. The FBI’s call is an official assessment, not a court verdict. U.S. officials and sanctions monitors say Pyongyang uses such thefts to fund its banned weapons programmes.
The numbers are hefty. Chainalysis counted $3.4 billion stolen across crypto in 2025, with at least $2.02 billion linked to North Korea, from fewer attacks but bigger ones. Its tally for the country since 2022 stood at $6.75 billion. Elliptic says the Binance theft alone almost doubles the regime’s known haul.
The attribution rests on more than the FBI. TRM Labs and Chainalysis are highly confident, partly because Binance proceeds mingled on-chain with funds from last month’s Bitget theft. Elliptic points to the same link, plus laundering services shared with earlier TraderTraitor thefts.
The Job Offer That Was Not
In 2022, according to The Block, citing people familiar with the matter, a senior engineer at the company behind Axie Infinity received a generous job offer on LinkedIn. Several rounds of interviews followed. Then came a PDF supposedly holding the terms. It held malware instead.
That opened the door to the Ronin network. Attackers took control of four of Sky Mavis’s validator nodes, then reached a fifth through the Axie DAO, enough of the nine to approve transfers. About $625 million in ether and USDC left. The U.S. government blamed Lazarus.
The trick never retired. Palo Alto Networks named the modern version Contagious Interview: fake recruiters on LinkedIn and Telegram invite developers to interviews and coding tests laced with malicious software. Binance has not said how its engineer’s laptop was compromised, but the genre fits.
When the Screen Tells Fibs
On February 21, 2025, Bybit’s signers approved what looked like a routine transfer between the exchange’s own wallets. The screen said so. The screen was wrong.
Attackers had compromised a developer’s machine at Safe{Wallet}, the wallet platform Bybit used, and slipped malicious JavaScript into the signing interface. The signers saw one thing and approved another. About 401,000 ETH, roughly $1.5 billion, went to the thieves, and the FBI named North Korea’s TraderTraitor.
The lesson travelled well. Nobody picked the lock or copied the key. The attackers went after the people and programs that tell the lock when to open. Elliptic sees the same pattern at Binance: the systems around the wallets were compromised, not the cryptography. The two thefts are cousins, not twins, and Binance’s full mechanism is not yet established.
The Laundromat
Stolen crypto has one awkward feature: the ledger is public and permanent. Laundering cannot erase the trail, only tangle it until following it becomes hard work. That job has stages, and North Korea’s crews have refined them:
- Swap stablecoins, which issuers can freeze, into assets such as ether and bitcoin, which have no issuer to call.
- Hop between blockchains using bridges and instant-swap services.
- Split the loot into small pieces. North Korean launderers favour chunks of around $500,000, against the $1 million to $10 million typical of other thieves.
- Blend funds through mixers, decentralised exchanges and brokers, often Chinese-language services.
- Wait. Chainalysis sees the process unfold over roughly 45 days.
At the end sits the awkward part: turning coins into spendable money. The U.S. Treasury’s FinCEN named Cambodia-based Huione Group a critical laundering node for North Korean heists. A 2025 report by the Multilateral Sanctions Monitoring Team, an eleven-country group, found at least 19 Chinese banks used in laundering networks tied to North Korea.
Mixers attract trouble of their own. In 2022 the U.S. Treasury sanctioned the mixer Blender.io, citing its role in laundering the Ronin loot.
The Race to Freeze
Crypto has a few emergency brakes, and they sit with stablecoin issuers. Tether froze 1.18 billion USDT in the main thief wallet 37 minutes after it arrived, and Circle froze 823 million USDC about three minutes later. Ripple, World Liberty Financial, Paxos and First Digital froze their own tokens, and Arbitrum’s Security Council moved about $30 million out of reach.
By Elliptic’s count, about $2.85 billion, or 44% of the haul, has been frozen or seized, nearly all of it stablecoins. Binance puts the figure near $3 billion. The thieves knew the brakes existed: stablecoin swaps into ETH went through at losses of 12% to 26% against market price, which suggests they valued speed over profit.
What remains is the hard part. Elliptic’s latest count has the attacker controlling about $3.21 billion in assets no issuer can freeze, spread across dozens of addresses, including 18,270 BTC. Much of the laundering looks automated: the main Tron wallet made 546 transfers with a median gap of 96 seconds, receiving wallets passed funds on within about two minutes, and the activity ran through the night. Software, it seems, does not need sleep either.
Who Pays the Bill
Binance says users will not bear the loss. By October 31 it had replaced 90% of the stolen assets, and on November 1 it reported about 95%, with the rest being bought through market and over-the-counter trades. It set aside more than $6.34 billion, about $5 billion of it already held in the same tokens. SAFU, its futures insurance fund and corporate money sit behind that.
Withdrawals reopened in phases on November 1, Bitcoin first. The SAFU fund has history: Binance has fed it with a slice of trading fees since 2018, and drew on it after the 2019 hack that took 7,000 bitcoin, about $40 million then. The 2026 theft is around 150 times larger in dollars.
Recovery is a longer story. After Ronin, Chainalysis and U.S. law enforcement helped recover about $30 million of the $625 million, while the game’s maker repaid users from its own funding. Money stolen by state-backed crews rarely comes home in full.
What Ordinary Holders Can Do
The Binance heist hit a corporate target, but its lessons are small and domestic. Most of them cost nothing:
- Keep only trading money on exchanges. A hardware wallet suits long-term holdings, with the catch that its owner becomes their own bank manager.
- Use an authenticator app or a hardware security key instead of SMS codes.
- Check the recipient, amount and details of any large transaction on a trusted, separate device before approving it. Bybit’s signers trusted one screen, and it fibbed.
- Treat unsolicited recruiters, “coding tests” and downloads as suspicious, however fine the salary.
- After a big breach, expect copycat scammers, and trust official channels only.
None of this makes anyone hack-proof. The Binance thieves got past professionals, and professionals are who they hire themselves out against.
The story is still open. A full post-mortem is pending, billions remain unfrozen and on the move, and the crews behind it have both the time and the staff. In a trade where the villains work shifts, the defenders will need to as well.
FAQs
Binance says it will bear the loss, not users. It reported replacing about 95% of the stolen assets by November 1, using company funds including its SAFU fund, and began reopening withdrawals in phases, Bitcoin first.
The FBI attributed the theft to North Korea, naming the TraderTraitor activity. TRM Labs, Chainalysis and Elliptic reach the same conclusion. The FBI’s finding is an official assessment, not a court verdict.
Binance first said it found no evidence of a private key leak. It later reported additional points of breach and says the attack bypassed its normal approval controls. Elliptic’s analysis suggests Binance’s own systems were made to sign the transactions. A full report is pending.
Sometimes. Tether, Circle and others froze stablecoins within about 40 minutes, and Elliptic counts about 44% of the haul frozen or seized. Bitcoin and ether have no issuer who can freeze them, which is why thieves swap into them fast.
Yes, by most counts. Estimates run from $5.9 billion to $6.43 billion depending on timing. Elliptic says it is more than four times the $1.46 billion stolen from Bybit in 2025, the previous record.
Login with Google