[Hack. Photo Credit to Pixabay]

On October 29th ET, Binance announced that 6.3 billion dollars worth of digital coins were stolen from its digital wallet, marking the largest crypto heist in history. 

Expert crypto tracing companies attributed this attack to North Korea due to similar patterns and past incidents.

Binance, the world's largest crypto exchange platform established in 2017. Customers  store cryptocurrencies in digital wallets which was what was breached on the 29th.

Chainanalysis  - a crypto tracing and forensics organization – reported that the hack began at 4:20pm.

"An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," TRM Labs – a blockchain cybersecurity company – stated.

This marks the largest cryptocurrency theft in history.

Binance immediately suspended deposits and withdrawals to allow security checks to be completed.

About an hour later, a collaborative effort between cryptocurrency firms and law enforcement began and managed to freeze about 3 billion dollars of the stolen money mid–transport.

Freezing in this context, refers to suspending it mid-transport, out of the hackers’ reach.

The company assured that they are working to trace and restore the stolen funds.

As of now, it has pledged to cover all losses for its customers with its own funds.

Binance co-CEO Richard Teng stated on X that the attack was a complex, planned process rather than a “one-click” action.

Initially, it appeared as if the hack went through an individual engineer’s laptop. However, on the 30th the company confirmed additional points of breach.

Multiple crypto-tracing companies attributed this attack to North Korea’s elite hacking unit, TraderTraitor.

“We make this judgment with high confidence," they said on their website on the 29th. This was “based on robust on and off-chain intelligence” and “several features of this attack [that] match earlier North Korea-linked heists.”

Chainalysis noted on its website that funds stolen from Binance commingled with funds stolen from last month's Bitget exploit, which was also attributed to North Korea.

In 2022, the FBI, Cybersecurity and Infrastructure Security Agency (CISA), and United States Treasury Department first used the name TraderTraitor to describe cyberattack campaigns and malicious applications associated with North Korea’s hacking organization –the Lazarus Group.

In 2026, Chainanalysis identified TraderTraitor as a North Korean financial cyberoperations unit that specifically targets software developers and IT personnel at cryptocurrency firms. 

Cryptocurrencies facilitate borderless transfers, which experts suspect North Korea exploits to finance weaponries.

Experts suggested that North Korea fragmented the money into thousands of transactions and laundered it.

Michael Vanhart, an analyst at DTEX, a U.S. cybersecurity firm, said “North Korea has sent troops, ammunition, and weapon parts to Russia, all funded through the same financial network.” 

Additionally, North Korea has a long history of crypto hacking. 

According to TRM Labs, ⅗ of the largest cryptocurrency hacks in history have been attributed to North Korea.

Notably, TraderTraitor was also behind the February 2025 attack on another cryptocurrency exchange Bybit  and stole 1.5 billion dollars.

A report by Chainanalysis estimated North Korea had stolen 6.75 billion dollars by the end of 2025. 

With Binance’s 6.3 billion dollars and 387 million dollars from Bitget, the total is at least 13.5 billion dollars. 

These past incidents have led many to believe that North Korea is behind this recent attack as well.

When asked about North Korea’s attribution, a Binance spokesperson said that the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."

Further investigations are ongoing.

The FBI stated on the 30th that it is “engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps.”

Chainanaylsis stated on its website that it is completely committed to supporting Binance to trace the stolen funds and work to lessen additional losses. 

Meanwhile, withdrawals on Binance are expected to be available again starting on Sunday.