Binance loses billions in multi-chain theft attributed to North Korea
Binance's October 29 breach became the largest known cryptoasset theft by reported value. The attack included a substantial Bitcoin loss and forced an emergency response across custody systems, token issuers and law enforcement.
At approximately 20:05 UTC on October 29, 2026, unauthorized withdrawals began from Binance's hot wallets. In its October 30 institutional update, the exchange estimated losses of approximately $6.3 billion across several assets, including bitcoin. The incident placed one of the largest gateways to cryptocurrency markets in an immediate custody and liquidity crisis.
Elliptic's subsequent analysis put the stolen assets at $6.43 billion across eleven blockchains and identified 18,270 BTC, valued at approximately $1.48 billion at the time of theft. The total was therefore not a Bitcoin-only loss. Elliptic compared it with the $1.46 billion Bybit theft of February 2025, calling Binance the largest cryptoasset theft and assessing it as almost certainly the largest known theft of any kind. That broader comparison was the firm's assessment, rather than a prediction that no future theft could exceed it.
Hot wallets support an exchange's operational transfers. Their convenience depends on systems that can authorize transactions, making the controls around signing as consequential as possession of the underlying keys. A compromise of those controls can turn valid blockchain transactions into unauthorized movements from the customer's point of view. Successful settlement on a blockchain does not demonstrate that an exchange's internal authorization process was legitimate.
Binance initially identified a potentially compromised laptop, then reported additional points of compromise. It said it had found no evidence that wallet private keys had leaked. The distinction left open how its infrastructure had been induced to authorize the transfers; the complete intrusion path remained under investigation. The incident did not establish that Bitcoin signatures or consensus had been broken.
The exchange suspended withdrawals, revoked affected authorizations and said it had added controls. It committed to absorb the loss through SAFU and its corporate treasury, reporting that it had set aside more than $6.34 billion. That was a company statement about coverage, not an independently completed audit or proof that stolen assets had already been returned. Restoring withdrawal service remained subject to security checks.
The response exposed important differences between assets. Elliptic's November 1 update verified approximately $2.85 billion frozen or seized, predominantly issuer-controlled stablecoins, against Binance's approximate $3 billion figure. Frozen assets were not synonymous with money recovered into customer custody. Bitcoin lacked an issuer able to impose an equivalent address freeze; Elliptic reported that the stolen BTC had been divided among addresses rather than immobilized through issuer action.
On October 31, the FBI attributed the attack to North Korea's TraderTraitor activity. Working with the U.S. Secret Service and IRS Criminal Investigation, it reported observing conversions primarily into ether and warned that further laundering through decentralized-finance and instant-swap services was expected. The agencies published associated addresses and called on intermediaries and infrastructure operators to block related transactions. Attribution and address publication were later investigative stages, separate from the October 29 theft.
The breach brought three different security responsibilities into the same event: preventing unauthorized signing, maintaining a solvent and accessible exchange after losses, and tracing assets after transactions had settled. Replacing lost assets could protect account balances without repairing the original control failure. Tracing could identify funds without guaranteeing their recovery. A promise to reopen could not itself demonstrate that the affected systems were safe.
By the beginning of November, the documented consequences included suspended access, emergency control changes, a large corporate replacement commitment and a coordinated international tracing effort. The full technical post-mortem and longer-term security effects remained unsettled. The scale made those questions urgent, but did not justify treating future reforms or complete recovery as accomplished facts.