FBI Blames North Korea for Binance Hack
The Federal Bureau of Investigation confirmed on October 31, 2026, that North Korean hackers orchestrated the theft of approximately $6.3 billion in digital assets from the Binance cryptocurrency exchange. The breach occurred on October 29 at 4:20 PM Eastern Time, marking the largest single cryptocurrency heist in history.
Compromised Laptop Allows Hackers to Drain Binance Wallets
Malicious actors targeted ten different blockchain networks within Binance, draining wallets in real time. According to The Dong-A Ilbo, the incident began when an internal engineer’s laptop was compromised, granting unauthorized access to the exchange’s transaction approval system. A security monitor in Abu Dhabi first flagged an abnormal outflow exceeding $1 billion at 4:20 PM.
Binance executives convened an emergency crisis team numbering around 100 individuals. Co-CEO Yi He managed the situation from the United Arab Emirates while co-CEO Richard Teng joined via an emergency telephone bridge from Hong Kong, watching helplessly as the total loss climbed past $3 billion and ultimately surpassed $6 billion within twenty minutes, The Hankyoreh noted. The speed of the attack overwhelmed standard administrative protocols. Automated scripts executed thousands of transactions simultaneously to obscure the money trail, utilizing mixing services and decentralized finance platforms.
Ari Redbord, global policy head at TRM Labs, told Bloomberg that North Korea took in a single night an amount roughly equal to everything they stole over the past six years combined, characterizing the event as the largest bank robbery in human history. The damage dwarfed the $1.5 billion stolen from the Bybit exchange by North Korean actors in February 2025.
Stablecoin Issuers Freeze Funds While Hackers Use Aave
Following the initial breach, Binance partnered with blockchain forensic firms including TRM Labs, Chainalysis, and Elliptic to map stolen wallet addresses and coordinate with stablecoin issuers. Tether and Circle placed immediate blacklists on targeted accounts, freezing roughly $3 billion of the stolen capital. However, attackers outpaced centralized controls by funneling approximately $60 million of stablecoins into the decentralized lending protocol Aave. Hackers used these funds as collateral to borrow roughly 20,000 Ethereum units valued at $44.6 million before platform operators could halt the transactions, rendering those assets impossible for any central issuer to freeze.
Federal investigators identified the perpetrator as TraderTraitor, a hacking organization linked to North Korea that has been tracked by United States law enforcement since 2022. Chainalysis data indicates that North Korean groups account for 89 percent of all global cryptocurrency theft volumes recorded this year. The U.S. Secret Service and Internal Revenue Service Criminal Investigation division joined the FBI in ongoing multi-agency recovery efforts.
Binance Uses Corporate Reserves to Cover User Shortfall
To prevent systemic contagion across global digital asset markets, Binance founder Changpeng Zhao posted on social media that user funds remain secure under the exchange’s SAFU reserve framework. The platform announced plans to deploy its own corporate reserves totaling approximately $6.34 billion to cover the shortfall entirely, initiating phased restorations of normal withdrawal services.
Trump Discusses North Korea as FBI Tracks Stolen Assets
United States President Donald Trump stated to reporters at his Mar-a-Lago estate on the same day when asked about the Binance breach: I do not know yet if it was North Korea
and added: If North Korea did it, I will talk to North Korea about that matter.
Although the FBI announced that TraderTraitor actors were observed converting stolen assets primarily into Ethereum and utilizing decentralized finance and instant exchange services for further laundering, investigators noted that additional intrusion points were discovered during follow-up investigations, leaving the exact initial attack path and the full extent of the compromised wallet inventory still under active scrutiny.