The world’s largest cryptocurrency exchange, Binance, confirmed on October 29, 2026, that it had been hit by a record $6.3 billion (£4.7bn) hack, described as the biggest heist in history. The exchange immediately pledged to cover all customer losses, freezing $3 billion of the affected assets and setting aside an additional $6 billion from its $167 billion balance sheet to shore up further losses.
$6.3 Billion Heist: North Korea Blamed
Analysts and researchers identified North Korea as the likely culprit behind the unprecedented attack. The Federal Bureau of Investigation (FBI) named the Democratic People’s Republic of Korea as responsible for the incident. TRM, a crypto analysis firm, attributed the attack with high confidence
to TraderTraitor, North Korea’s elite hacking unit, a conclusion shared by Elliptic and Chainalysis.
Engineers Infected with Tampered Installer
Binance detailed the multi-month infiltration used by the attackers in a November 3 disclosure. The campaign involved three engineers across several months. In June 2026, an engineer on Binance’s wallet development and operations team downloaded a tampered Homebrew installer while trying to install a popular AI coding tool. The company’s security team detected the anomaly. They replaced the affected device and changed related credentials. But the attack had already exposed the engineer’s role and colleagues working on the wallet infrastructure.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
In September, the attackers posed as recruiters. They ran a series of fake job interviews with another engineer. This led to a coding exercise that contained hidden malware designed to evade security. The attackers spent months building their way in. On October 20, they used the compromised computer and an internal AI tool to access other employees. This included one with a container deployment permission token.
Replenishing Stolen Customer Assets
Following the attack, Binance suspended withdrawals and began an immediate recovery effort. As of November 1, the exchange had replenished approximately 98% of the $6.34 billion in affected assets, according to an update from Binance. The company said it had set aside more than 100 per cent of the funds required to cover the stolen assets from its own resources. This ensured customers would not bear the financial impact.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
By November 4, Binance announced it had replenished approximately 98 per cent of the impacted token assets, up from the 95 per cent disclosed in a previous update. The remaining two per cent consists of less liquid tokens that require more time to acquire in the required quantities. Premium Times Nigeria reported that Binance had already frozen or intercepted about $2.85 billion in assets through a coordinated effort with partners like Tether, Circle, and Ripple.
The hack sent ripples through the crypto markets. Within hours of the news breaking in early Asian trading on Friday, The Guardian reported that bitcoin had fallen 5% from its level before the hack broke. It dropped to $77,380, its lowest level in six weeks. Binance co-founder CZ Zhao posted to X to say user funds are safe. But he added the incident appears to be a hack.
Moving Stolen Funds Through Wallets
The stolen funds are being moved through complex and automated laundering operations. According to blockchain analytics firm Elliptic, in the first three and a half days after the hack, the attackers used about 12,000 wallets across 11 blockchains. They made a new wallet roughly every 25 seconds. As of November 5, about $3.35 billion remains in addresses linked to the theft, mostly as ETH and BTC. Elliptic estimates that only a negligible amount has likely been cashed out.
The FBI’s investigation prompted a response from the crypto industry and regulators. The bureau published 628 crypto addresses linked to the theft and called on crypto services companies to block transactions with them. The alert did not name banks. According to American Banker, little of the stolen money appears to have come near a traditional bank.
Binance Co-CEO Richard Teng: “We now are operating, we are protecting every user, and we are extremely thankful for our users’ confidence and trust” Speaking with @DarrenBotelho on @FoxBusiness, Richard explained how Binance is protecting users and replenishing impacted assets,… pic.twitter.com/ivryx12eHl
Rebuilding Wallet System After Breach
In the wake of the breach, Binance has undertaken a comprehensive security overhaul. The exchange has rebuilt the affected wallet system in a new environment. It rebuilt its internal AI tool and access controls. The exchange replaced compromised devices and decommissioned credentials and tokens associated with the affected employees. Premium Times Nigeria reported that Binance security had detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026.
Binance co-CEO Richard Teng told CNBC that the company is getting an independent expert to review its security measures. He said it will continue to strengthen its defenses as the investigation continues. The exchange has also pledged to publish a comprehensive post-incident report after completing its investigation. This will promise further details about the breach and the measures taken to prevent a recurrence.
An update on the security incident. pic.twitter.com/qn2804fO5z
More on Binance
Over the past 24 hours, our teams have been working around the clock to respond to a serious security incident involving unauthorized withdrawals of funds. This is a live update on where things stand – what we've done, what we've learned, and what comes next.Bottom line:… https://t.co/Gk3N0HhrMU
“The difference is verification, not just promises.” That’s what I told @CNBC today, speaking on the security incident and the steps we’ve taken since 29 October to ensure our users are protected. We’re now 98% replenished. We’ve completed the latest Proof of Reserves… pic.twitter.com/1Vl3pM3YjO
North Korea denies the Binance hack. Several crypto forensic firms have linked the Binance hack to North Korean state-backed attackers https://t.co/BXaZPLT9mA
Latest JNLR Radio Listenership Figures: RTÉ, Newstalk, and Today FM Results
The 16,000 Listener Exile: Why RTÉ's Drivetime Is Losing Ground in Ireland's Radio Wars In the high-stakes arena...
Actress Kimmarie Johnson Dead at 50 After Heart Event
Actress Kimmarie Johnson, best known for her roles in "Beverly Hills, 90210" and "Dude, Where's My Car?", has...
Brent Crude Slumps as Democratic US Election Win Boosts Asian Stocks
Asian stocks rallied on Thursday, November 5, 2026, as oil prices plunged following a Democratic sweep in the...
Elton John and CMAT team up on festive duet Step Into Christmas
CMAT and Elton John have collaborated on a new rendition of his festive hit Step Into Christmas. The...