Binance Hack 2026: FBI Blames North Korea for $6.3B Theft

Crypto has seen big thefts before. It had never seen one like this. In the space of about twenty minutes on 29 October 2026, attackers pulled most of a roughly $6.3 billion haul out of Binance, the largest cryptocurrency exchange in the world, moving the money across ten different blockchains almost simultaneously. As Al Jazeera reported, it is, by a wide margin, the biggest crypto heist in history. Days later, the FBI pointed at a familiar culprit. Here is what actually happened, who is blamed, and what it means if you hold coins on an exchange.

What happened in the Binance hack?

According to Binance's own disclosures and wire reporting, the exchange detected unauthorised outflows on 29 October and moved to halt withdrawals while it contained the incident. The scale is what sets it apart: around $6.3 billion drained in a single, fast, coordinated operation spread across ten chains, with most of the money gone in roughly twenty minutes and smaller sweeps continuing for a few hours after.

The speed and breadth are the tell. A theft that empties ten blockchains that fast is not someone guessing a password. It is an operation with deep, privileged access, prepared in advance and executed the moment the window opened.

Binance has not published a confirmed root cause, and says it found no evidence that a private key was leaked. The leading analyst inference is a compromise of Binance's hot-wallet signing infrastructure, which would explain valid-looking transactions firing across all ten chains at once. On the Ethereum leg specifically, the attacker abused EIP-7702 (a new Ethereum feature that lets a wallet delegate control to code) to turn a hot wallet into an automated sweeper, which amplified the losses there; an early theory that this leg began with phishing has largely been set aside, because it cannot explain the simultaneous multi-chain drain. The parallel most analysts draw is the 2025 Bybit theft, also tied to North Korea, where the signing process rather than the cryptography was subverted. Treat the mechanism as an informed inference, not an established fact.

How much was stolen, and is this the largest crypto theft ever?

Yes. At roughly $6.3 billion, the Binance hack dwarfs every previous crypto theft on record. For scale, here is how it compares with the biggest heists of recent years.

Incident	Year	Approx. amount	Attributed to
Binance	2026	~$6.3 billion	North Korea (per FBI)
Bybit	2025	~$1.5 billion	North Korea (Lazarus)
Ronin Bridge	2022	~$625 million	North Korea (Lazarus)
Poly Network	2021	~$611 million	Returned by attacker

One caveat worth keeping: the precise total, the number of wallets involved, and how much has since been frozen are figures that on-chain analysts have estimated. The widely cited "$6.3 billion" rounds TRM Labs' estimate of about $6.36 billion; the FBI's own alert put it more cautiously at "more than $6 billion." Treat the exact numbers as provisional until the forensic accounting settles.

Who hacked Binance? The North Korea attribution

On 31 October 2026, the FBI issued an alert attributing the heist to North Korean state hackers, the cluster it tracks as TraderTraitor, a North Korea-linked unit within the broader Lazarus Group ecosystem, a link reported by BleepingComputer the following day. That is the same playbook investigators tied to the $1.5 billion Bybit theft in 2025, where attackers compromised the infrastructure used to approve transactions rather than breaking the cryptography itself.

Precision matters here. The FBI made the attribution; Binance has not publicly named the attacker, saying only that it is working with law enforcement to confirm who was responsible. The attribution was not universally accepted at first either: asked about it the night it was announced, President Trump said the US did not yet know whether North Korea was behind the theft. Attribution in state-level cyber operations is a judgement built from on-chain tracing and intelligence, not a courtroom verdict, so the honest line is that the FBI blames North Korea and the pattern fits, while some caution remains.

Is my money safe on Binance?

For Binance customers, the practical answer is reassuring, with a caveat. Binance says it has replenished about 95 percent of the stolen value from its own reserves (around 90 percent in the first day), drawing on its SAFU insurance fund, its futures insurance fund, a Bitcoin reserve and corporate treasury, and has pledged to cover the rest. The remainder, reported to be in less-liquid tokens, is still being made good, so "nearly all replenished" is not quite the same as every balance already whole. That is the point of an exchange of Binance's size holding a loss-absorbing reserve: a catastrophic theft becomes the company's problem, not yours, provided the company is solvent enough to eat it.

The caveat is the one this whole saga underlines. Coins on any exchange are a claim on that company, not assets in your sole control. Binance could cover this; a smaller venue might not have survived a loss a fraction of the size. If you hold more than you are willing to trust to a third party, the lesson is the familiar one, explored in our guide to the best crypto wallets of 2026 and how to buy and hold crypto safely: self-custody removes counterparty risk, at the cost of taking on the responsibility yourself.

Have Binance withdrawals resumed?

Yes. After pausing withdrawals to contain the incident, Binance restored them on 1 November, starting with Ether, USDT and USDC on Ethereum and USDT, USDC and BNB on BNB Smart Chain, with other assets and networks phased back in after security checks. A pause like that is standard incident response, it stops attackers and panicking users draining the same pipes at once, but it is also exactly the moment scammers pounce. Treat any message offering to "recover" your funds, verify your wallet, or restore frozen access as hostile. Binance will never ask for your seed phrase or private keys, a threat we covered in crypto wallet data breaches and wrench attacks.

What the Binance hack means for crypto security

The uncomfortable takeaway is that the weak point was not the blockchain. The chains did exactly what they were built to do; the theft came through the human and infrastructure layer that sits on top, the same soft target hit in the Bybit, Ronin and other Lazarus-linked operations. North Korea has turned crypto theft into a national revenue stream, and the biggest exchanges are now a strategic target, not just an opportunistic one.

It also sharpens a question the industry keeps dodging: if the largest, best-resourced exchange on earth can lose $6.3 billion in twenty minutes, the security that matters is operational, who can sign a transaction, under what controls, and how fast an anomaly is caught, not the cryptography everyone likes to talk about. For holders, the recurring conclusion from every one of these incidents, from the Coldcard firmware flaw to the Ledger supply-chain attack, is the same: understand where your coins actually live, and who can move them.

Frequently asked questions

How much was stolen in the Binance hack?

Roughly $6.3 billion was drained across ten blockchains on 29 October 2026, most of it in around twenty minutes, making it the largest cryptocurrency theft on record. That round figure reflects TRM Labs' estimate of about $6.36 billion; the FBI's alert put it at "more than $6 billion." The exact total, affected wallet count and frozen amounts may be revised.

Who was behind the Binance hack?

On 31 October 2026 the FBI attributed the heist to North Korean state hackers, the group it tracks as TraderTraitor, part of the Lazarus Group ecosystem. Binance itself has not publicly named the attacker. It is the same North Korean operation investigators linked to the 2025 Bybit theft.

Did EIP-7702 cause the Binance hack?

No. EIP-7702 is a 2025 Ethereum feature that lets a wallet temporarily delegate control to code. On the Ethereum leg of the theft the attacker abused it to turn a compromised hot wallet into an automated sweeper, which amplified the losses there, but it did not cause the breach, which hit ten chains at once. Analysts point to a compromise of Binance's signing infrastructure as the likely root cause.

Is my money safe on Binance after the hack?

Binance says it has replenished about 95 percent of the stolen value from its own funds (around 90 percent in the first day) and has pledged to cover the rest; the remainder, in less-liquid tokens, is still being made good, and withdrawals have resumed. The broader risk remains that coins on any exchange are a claim on that company rather than assets you solely control.

Will Binance compensate affected users?

Binance says customer balances are being made whole from its own reserves (its SAFU and futures insurance funds, a Bitcoin reserve and corporate treasury), and it set aside funds to cover the losses. Separately, stablecoin issuers froze some of the stolen money, with Tether and Circle freezing portions of the USDT and USDC the attacker moved.

Have Binance withdrawals resumed?

Yes. Binance paused withdrawals to contain the attack and then restored them on 1 November, starting with major assets on Ethereum and BNB Smart Chain and phasing in the rest. Be wary of "fund recovery" or "verification" messages during this period, they are a common scam, and Binance will never ask for your seed phrase or private keys.

Did the Binance hack move crypto prices?

Bitcoin and Binance's own BNB token dipped on the news on 29 October as the scale of the theft became clear. The market steadied after Binance halted withdrawals and said it would cover the losses from its own funds, which limited the contagion a loss of this size might otherwise have caused.

Is this the biggest crypto hack ever?

Yes. At about $6.3 billion, the Binance hack is by far the largest crypto theft recorded, well ahead of the 2025 Bybit hack (around $1.5 billion) and the 2022 Ronin Bridge hack (around $625 million).