Analysts link the Binance hack to North Korea as the exchange secures about $3 billion in frozen funds and works to restart withdrawals.
Tamrah News Desk | 30 October 2026
The Binance hack took about $6.3 billion from the world’s largest crypto exchange on Thursday, and blockchain analysts have linked the theft to North Korea, according to Reuters in a report carried by the Lufkin Daily News. Binance suspended withdrawals, promised to cover customer losses and began working with partners to freeze stolen funds. Analysts told Reuters the record theft could shake faith in digital assets.
What Happened in the Binance Hack
Reuters reported that most of the theft unfolded in about 20 minutes, beginning late on Thursday. AFP, in a report carried by France 24, described Binance as the world’s largest crypto exchange by daily trading volume. TRM Labs, a US blockchain analysis firm, said roughly $6.36 billion left Binance wallets across ten blockchains, according to a wire report published by U.S. News. That would make it the largest crypto hack on record.
CNBC reported that TRM Labs found preparations began at least 36 hours before the theft, with attackers using the mixing service Tornado Cash to fund their wallets.
Estimates of the total differ. Binance puts the impact at $6.3 billion, while Chainalysis says $6.4 billion. CNN described the theft as more than $6 billion.
Why Analysts Blame North Korea
TRM attributed the attack with high confidence to TraderTraitor, which it describes as an elite North Korean hacking unit. In a blog post, Chainalysis reached the same view on TraderTraitor. It said stolen funds from Binance mixed on the blockchain with money taken in last month’s Bitget exploit, which had been attributed to North Korea. CNN reported that Pangolin Intelligence, a blockchain tracking firm in Singapore, also believes a North Korean unit was behind the theft.
Help Net Security noted that the FBI named TraderTraitor in the $1.5 billion Bybit hack of February 2025, and that by TRM’s count the Binance theft is about four times larger. Crypto.news reported that TraderTraitor is associated with the Lazarus Group.
Binance has not named an attacker. Reuters reported that executive Richard Teng said the investigation has not assigned responsibility to any individual.
How the Breach Happened
The crypto exchange said early findings pointed to a compromised laptop belonging to a DevOps engineer, which let an attacker reach a service container and submit unauthorized withdrawals, CNBC reported. AFP later reported that Binance had uncovered additional points of breach beyond the laptop. Binance said it found no evidence of a wallet private key leak, according to Help Net Security, and plans to publish a technical analysis once its investigation ends.
What Happens to the Frozen Funds
Reuters reported that stablecoin issuers including Tether, Circle and World Liberty Financial quickly froze about half of the stolen funds. Binance said it had located about $3 billion in frozen funds so far. It did not give the status of the remaining $3.3 billion in stolen funds, according to Reuters.
Freezing is not the same as recovery. Ari Redbord of TRM Labs told CNBC,
“A freeze stops the money from moving, and recovery follows through legal process.”
Eric Jardine, head of research at Chainalysis, told CNBC that bitcoin and ether cannot be frozen by an issuer but can still be traced. He added that recovering frozen funds needs coordination between law enforcement, exchanges and token issuers. Chainalysis said it continues to trace stolen funds.
Will Binance Withdrawals Resume Soon?
Binance said deposits are unaffected and that it expects to resume Binance withdrawals within 48 hours, according to CNBC. CNN reported the exchange expects services back by Sunday morning. Binance pledged to cover all losses, CNBC reported. Teng wrote on X,
“Your money is safe and we’re covering every loss,”
according to Reuters.
Market Reaction to the Largest Crypto Hack
AFP reported that Bitcoin fell nearly 5 percent and Ether nearly 6 percent, while BNB dropped nearly 10 percent. Investing.com reported that Bitcoin reached a six week low and that shares of crypto linked companies such as Hut 8 and Robinhood fell 5.7 percent. Reuters said confidence also weakened in listed crypto exchange shares. CNBC reported that Hyperliquid’s HYPE token rose 9 percent against the trend. .
Why North Korea Targets Crypto Exchanges
The U.S. News wire report said experts believe North Korea turned to crypto hacking to earn badly needed foreign currency for its economy and nuclear program after tough United Nations sanctions. TRM said several features of the attack match earlier North Korean thefts, including the Bybit hack. For wider context, see our Business and Markets Category.
Conclusion
The Binance hack is the largest crypto hack on record, and analysts point to North Korea’s TraderTraitor group, citing similarities with the Bybit hack. About $3 billion in frozen funds has been secured, but the fate of the remaining stolen funds is unclear, and Binance withdrawals are expected to restart within 48 hours. Anyone searching for Binance hack North Korea updates should watch for Binance’s technical report and any statement from US authorities.
