World

DevOps

Liberty

Ronin

Pangolin

<div class="light-yellow-block">
 <h2 id="strong-key-takeaways-strong"><strong>Key Takeaways</strong></h2>
 <ul>
  <li><strong>Compromised engineer laptop enabled unauthorized withdrawals.</strong></li>
  <li><strong>Binance estimates impact at about $6.3 billion.</strong></li>
  <li><strong>Around $3 billion frozen with blockchain partners.</strong></li>
  <li><strong>TRM, Chainalysis tie attack to North Korea.</strong></li>
 </ul>
</div>
<p><a href="https://www.cnn.com/2026/10/30/tech/binance-crypto-heist-hnk-intl" rel="noopener noreferrer nofollow">CNN reported</a> early Friday that hackers had stolen more than $6 billion from Binance, with several investigators pointing to North Korea and Chainalysis saying it had high confidence in that attribution.</p>
<p>The outflows were first spotted on Thursday evening, when <a href="https://coindoo.com/binance-hack-fears-shake-crypto-2-8b-outflows-reported/" rel="noopener noreferrer nofollow">about $2.8 billion was reported leaving Binance wallets</a>, and Binance founder Changpeng Zhao later said <a href="https://coindoo.com/binance-founder-cz-confirms-hack-user-funds-safe/" rel="noopener noreferrer nofollow">it looked like a hack</a>. Since then, the picture has changed substantially.</p>
<h2 id="what-binance-has-now-confirmed">What Binance has now confirmed</h2>
<p>In an update on <a href="https://x.com/binance/status/2115993361517891592" rel="noopener noreferrer nofollow">its official X account</a>, Binance moved from “investigating reports” to a confirmed incident:</p>
<div style="margin: 22px 0; border: 1px solid rgba(240,185,11,0.45); border-radius: 12px; overflow: hidden; font-size: 15px;">
 <div style="display: flex; flex-wrap: wrap; gap: 4px 14px; padding: 12px 16px; border-bottom: 1px solid rgba(148,163,184,0.25);"><strong style="flex: 0 0 120px; color: #f0b90b;">Cause</strong><span style="flex: 1 1 220px;">A compromised DevOps engineer’s laptop gave the attacker access to a service container used to submit unauthorized withdrawals</span>
 </div>
 <div style="display: flex; flex-wrap: wrap; gap: 4px 14px; padding: 12px 16px; border-bottom: 1px solid rgba(148,163,184,0.25);"><strong style="flex: 0 0 120px; color: #f0b90b;">Private keys</strong><span style="flex: 1 1 220px;">No evidence of any wallet private key leak</span>
 </div>
 <div style="display: flex; flex-wrap: wrap; gap: 4px 14px; padding: 12px 16px; border-bottom: 1px solid rgba(148,163,184,0.25);"><strong style="flex: 0 0 120px; color: #f0b90b;">Estimated impact</strong><span style="flex: 1 1 220px;">About $6.3 billion</span>
 </div>
 <div style="display: flex; flex-wrap: wrap; gap: 4px 14px; padding: 12px 16px; border-bottom: 1px solid rgba(148,163,184,0.25);"><strong style="flex: 0 0 120px; color: #f0b90b;">Frozen</strong><span style="flex: 1 1 220px;">About $3 billion on-chain, with partners including Tether, Circle, Ripple, World Liberty and Paxos</span>
 </div>
 <div style="display: flex; flex-wrap: wrap; gap: 4px 14px; padding: 12px 16px; border-bottom: 1px solid rgba(148,163,184,0.25);"><strong style="flex: 0 0 120px; color: #f0b90b;">Accounts</strong><span style="flex: 1 1 220px;">Deposits and withdrawals suspended; the affected address’s authorization revoked</span>
 </div>
 <div style="display: flex; flex-wrap: wrap; gap: 4px 14px; padding: 12px 16px; border-bottom: 1px solid rgba(148,163,184,0.25);"><strong style="flex: 0 0 120px; color: #f0b90b;">Losses</strong><span style="flex: 1 1 220px;">To be covered from the SAFU fund and company funds</span>
 </div>
 <div style="display: flex; flex-wrap: wrap; gap: 4px 14px; padding: 12px 16px;"><strong style="flex: 0 0 120px; color: #f0b90b;">Next</strong><span style="flex: 1 1 220px;">An updated Proof of Reserves once remediation is complete, followed by a full technical post-mortem</span>
 </div>
</div>
<p>Binance said it is working with law enforcement and blockchain intelligence firms to trace and recover the funds, and told users to rely only on its official channels.</p>
<h2 id="how-the-attack-unfolded-according-to-investigators">How the attack unfolded, according to investigators</h2>
<p>Blockchain intelligence firm TRM Labs said about $6.36 billion was moved from Binance wallets across 10 blockchains on Thursday, <a href="https://www.upi.com/Top_News/World-News/2026/10/30/Binance-North-Korea-theft/8961793332095" rel="noopener noreferrer nofollow">most of it within about 20 minutes</a> starting at 4:05 p.m. US Eastern time, or 20:05 UTC. According to <a href="https://www.cnbc.com/2026/10/30/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next-.html" rel="noopener noreferrer nofollow">CNBC</a>, TRM said the attack showed preparation well before the theft, including transaction signatures obtained in advance.</p>
<p>That fits Binance’s own account: the attacker did not need the wallets’ private keys, because access to the internal withdrawal system was enough to push transfers out.</p>
<h2 id="why-investigators-point-to-north-korea">Why investigators point to North Korea</h2>
<p>TRM attributes the attack to TraderTraitor, a North Korean state-sponsored hacking group. The FBI <a href="https://www.nbcnews.com/tech/tech-news/fbi-says-north-korea-was-responsible-15-billion-bybit-hack-rcna193944" rel="noopener noreferrer nofollow">named the same group</a> as responsible for the $1.5 billion theft from Bybit in February 2025. Chainalysis chief executive Jonathan Levin also said the firm assessed TraderTraitor as the likely culprit, citing links to earlier attacks. North Korea has previously denied hacking crypto exchanges, <a href="https://www.axios.com/2026/10/29/binance-cyberattack-crypto-heist" rel="noopener noreferrer nofollow">Axios noted</a>.</p>
<p>The method points in the same direction. Two days before the theft, on October 27, Binance said it had blocked a week of North Korea-linked attacks from a campaign known as Contagious Interview, which uses fake job interviews to trick developers into running malicious code on their machines. Binance has not said whether the compromised engineer’s laptop is connected to that campaign.</p>
<p>If the estimates hold, the theft is more than four times the size of the previous record:</p>
<div style="margin: 22px 0; font-size: 14px;">
 <p style="margin: 0 0 4px;"><strong>Binance, October 2026</strong> · about $6.3B</p>
 <div style="height: 14px; width: 100%; border-radius: 4px; background: #ef4444; margin-bottom: 12px;"></div>
 <p style="margin: 0 0 4px;"><strong>Bybit, February 2025</strong> · about $1.5B</p>
 <div style="height: 14px; width: 24%; border-radius: 4px; background: rgba(148,163,184,0.7); margin-bottom: 12px;"></div>
 <p style="margin: 0 0 4px;"><strong>Ronin Network, March 2022</strong> · about $620M</p>
 <div style="height: 14px; width: 10%; border-radius: 4px; background: rgba(148,163,184,0.7);"></div>
</div>
<h2 id="where-the-money-is-now">Where the money is now</h2>
<p>About half of the stolen funds are frozen, mostly stablecoins whose issuers can block their own tokens. The rest is harder to reach. CoinDesk reported that the hacker had split about $1.4 billion in bitcoin across 19 wallets, an asset no issuer can freeze. A Pangolin Intelligence analyst told CNN that “the cat and mouse game has barely begun,” expecting North Korea to tap money-laundering networks to cash out.</p>
<p>Binance says users will not bear the losses, and its next disclosures will be the updated Proof of Reserves and the post-mortem. How quickly it reopens withdrawals, and how much of the unfrozen $3 billion investigators recover, are the open questions.</p>
<p style="text-align: center; font-size: 13px; opacity: 0.75;"><em>This is a developing story. Last updated: October 30, 2026.</em></p>
<p>The post <a href="https://coindoo.com/binance-confirms-biggest-ever-6-3b-hack-north-korea-blamed/" rel="noopener noreferrer nofollow">Binance Confirms Biggest-Ever $6.3B Hack, North Korea Blamed</a> appeared first on <a href="https://coindoo.com" rel="noopener noreferrer nofollow">Coindoo</a>.</p>

Binance Confirms Biggest-Ever $6.3B Hack, North Korea Blamed

Table of Contents

Coindoo.com

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!