Hackers Steal More Than $6 Billion From Binance in Biggest Crypto Heist Ever, Analysts Blame North Korea

NEW YORK, Oct. 30 (TodayViralUSA) — Investigators and crypto companies are racing to trace more than $6 billion in digital assets stolen from Binance, the world’s largest cryptocurrency exchange, in what blockchain analysts describe as the biggest theft in the industry’s history and have linked to a North Korean state-backed hacking group.

Funds began leaving Binance’s “hot wallets,” the internet-connected accounts exchanges use to process withdrawals, at about 4:20 p.m. Eastern time on Thursday, according to the blockchain analytics firm Chainalysis, which put the total at about $6.4 billion across multiple blockchains. Binance estimated the impact at around $6.3 billion. The previous record was the roughly $1.5 billion taken from the Bybit exchange in 2025.

About half frozen so far

Binance said about $3 billion of the stolen assets had been frozen on-chain with the help of partners, and that it would cover all losses from its SAFU emergency fund and company funds. “User funds are safe,” the exchange said in a statement, adding that it had temporarily suspended withdrawals while security checks were completed. Binance said its U.S.-facing exchange was not affected, the BBC reported.

Stablecoin issuers including Circle, which issues USDC, and Tether, which issues USDT, moved to freeze funds tied to the attack, CNBC reported. Chainalysis said the attacker tried to stay ahead of those freezes by swapping about $325 million in stablecoins for roughly $285 million in ether over about 20 minutes, before freezes began at 5:14 p.m. Eastern.

How the attack unfolded

Binance initially said the breach may have involved a compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container and allowed unauthorized withdrawals. It said it had found no evidence that wallet private keys were leaked. Co-Chief Executive Richard Teng later said the attack was more complex and likely involved more than one person, and that the hackers abused a blockchain feature known as EIP-7702 and used a “self-destruct mechanism” to erase their tools as they went, according to the BBC.

Chainalysis said that on Ethereum, the attacker used signed authorizations that let a Binance hot wallet run attacker-deployed code, then swept its assets into attacker-controlled addresses. Most of the money left Binance’s wallets in about 20 minutes.

The North Korea link

Both Chainalysis and TRM Labs attributed the theft to TraderTraitor, a North Korean cybercrime group with a long record of attacks on crypto firms. Chainalysis said its strongest evidence came when it watched funds stolen from Binance mix on-chain with funds taken in last month’s hack of the Bitget exchange, which had been attributed to North Korea. Pyongyang has repeatedly been accused of using crypto theft to help finance its weapons programs.

The U.S. Secret Service said its investigators were working “around the clock” to identify, freeze, trace and recover the funds, and the FBI said it was aware of the incident. Experts told CNBC that recovery is a “cat and mouse game,” as hackers use obfuscation techniques and professional laundering networks to convert stolen coins into cash.