---
title: "Binance Under Attack: North Korean Hackers Siphon $6.3B — Largest Crypto Hack in History"
description: "Binance suffered the largest hack in crypto market history: according to TRM Labs, hackers stole about $6.36 billion. The attack is attributed to North Korea's TraderTraitor group, and the exchange promises full reimbursement."
date: 2026-10-30T06:53:01.141Z
lang: en
url: https://xab.info/en/posts/binance-hack-north-korea-6-3-billion-tradertaitor
tags: [binance, cyberattack, north-korea, crypto-hack, tradertaitor, trm-labs]
author: "Darya Fomina"
publisher: "XAB.info"
---

# Binance Under Attack: North Korean Hackers Siphon $6.3B — Largest Crypto Hack in History

![Smartphone displaying the Binance logo in a person's hand against a crypto market chart background](https://xab.info/media/2026/10/30/binance-vzlom-kndr-6-3-mlrd-tradertaitor/binance-vzlom-kndr-6-3-mlrd-tradertaitor-1.webp)

## Key Points

- Binance fell victim to the largest hack in crypto history: TRM Labs estimates about $6.36 billion was stolen across 10 blockchain networks.
- Analysts attribute the attack with high confidence to elite North Korean hacking group TraderTraitor, controlled by Pyongyang.
- The attack vector was the compromise of hot wallet signing infrastructure, likely via a DevOps engineer's laptop.
- Tether, Circle, and others froze about $2.7 billion; over $2.4 billion in BTC and ETH remains with hackers and cannot be blocked.
- Binance suspended operations and committed to reimbursing losses via the SAFU fund, stating no user keys were leaked.

The world's largest cryptocurrency exchange, Binance, has fallen victim to a massive cyberattack that surpassed all previous digital asset incidents in terms of stolen funds. According to a report by analytical firm TRM Labs, published by Reuters and syndicated by CNN, the attackers managed to siphon digital assets across 10 different blockchain networks totaling approximately $6.36 billion. According to researchers, the bulk of the funds was transferred within just 20 minutes, indicating a high degree of preparation and pre-built infrastructure for asset withdrawal. RBC-Ukraine presents this data as a basis for assessing the scale of the incident.

### Attribution of the Attack to a North Korean Group

TRM Labs analysts with high confidence link the incident to the elite hacking group TraderTraitor, operating, in their estimation, under the control of the North Korean government. The report emphasizes that the conclusion is based on a complex of on-chain and off-chain data: “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust intelligence both on-chain and off-chain. We make this determination with high confidence.” At the same time, it is important to note that this is an expert attribution based on digital footprints, rather than a formal indictment or confirmation by North Korean state bodies.

### Attack Vector and Infrastructure Compromise

The primary vector of the attack was the compromise of the exchange's hot wallet signing infrastructure. According to an official Binance statement, preliminary investigation points to the potential compromise of a DevOps engineer's laptop. Gaining access to the internal infrastructure, the attackers were able to initiate unauthorized transactions. Meanwhile, the company states it has not yet found evidence of a leak of users' private crypto wallet keys, narrowing the scope of direct damage to the exchange's own operating systems.

### What Was Frozen Versus What Remained with Hackers

Market participants reacted swiftly: Tether, Circle, and others managed to freeze approximately $2.7 billion in stablecoins and tokens controlled by the attackers. At the same time, analysts estimate that over $2.4 billion in BTC and ETH remains in the hackers' possession and is unreachable for blocking, as these assets lack a centralized freezing mechanism. A reminder of the timeline: on the evening of October 29, it was reported that nearly $3 billion had been withdrawn from hot wallets, and TRM Labs' final estimate for the entire incident totaled about $6.36 billion.

### Binance's Response and Commitments to Users

Pending the investigation, Binance temporarily suspended deposits and withdrawals. The exchange announced cooperation with law enforcement and blockchain analysis specialists to track and recover the stolen assets. The company also publicly committed to covering all losses using its SAFU emergency insurance fund and corporate reserves, which should alleviate the urgency for asset holders on the platform.

### Significance of the Incident for the Market

Due to the combination of factors—record-breaking amount, speed of withdrawal, and attribution of the attack to a state-backed group—this incident sets a precedent for the entire industry. It once again raises questions about the vulnerability of hot wallets and internal IT processes of major platforms, and reinforces the thesis that cyberattacks on crypto infrastructure are increasingly targeted and state-sponsored. Future dynamics will depend on the results of the joint investigation by Binance and law enforcement, as well as whether at least a portion of the frozen assets can be recovered.

## Fact-Check & Sources

- [За самым большим в истории взломом Binance стоят хакеры из КНДР, - СМИ](https://www.rbc.ua/ukr/news/naybilshim-istoriyi-vzlomom-binance-stoyat-1793342671.html) - The primary source (RBC-Ukraine referencing CNN and a TRM Labs report published by Reuters) confirms the hack, the ~$6.36B amount, the ~$2.7B freeze, and Binance's reimbursement commitments. The TraderTraitor/North Korea attribution is presented as TRM Labs' expert assessment with 'high confidence,' which is reflected in the status.

## FAQ

### What is the total amount of stolen assets?

According to TRM Labs, attackers stole approximately $6.36 billion across 10 blockchain networks. On the evening of October 29, reports indicated nearly $3 billion was withdrawn, with the final assessment reaching about $6.36 billion.

### Who, according to analysts, is behind the attack?

TRM Labs attributes the attack with high confidence to the elite North Korean hacking group TraderTraitor, controlled by Pyongyang. This is an expert attribution based on on-chain and off-chain data, not a formal accusation.

### How exactly was the hack executed?

The main vector was the compromise of the hot wallet signing infrastructure. According to preliminary Binance data, it involves the potential compromise of a DevOps engineer's laptop, granting attackers access to internal infrastructure.

### Were users' private keys leaked?

Binance states it has not yet found evidence of a leak of users' private crypto wallet keys.

### Will users be compensated?

Yes. Binance announced it will reimburse all losses through the SAFU emergency insurance fund and exchange funds, and suspended deposits and withdrawals during the investigation.