Hackers took about $6.3bn in digital assets from Binance, the world's largest cryptocurrency exchange, on 29 October. Most of the money left the exchange's wallets across ten blockchains in roughly 20 minutes. Tom Robinson, chief scientist at Elliptic, a blockchain-analysis firm, said it was "almost certainly the single largest-known theft of any kind". The previous record for a crypto theft was the $1.5bn taken from Bybit, another exchange, in February 2025.
The attackers broke into a "hot" wallet, which an exchange keeps online to process withdrawals. Binance first said that a compromised laptop belonging to a software engineer had been used to make unauthorised withdrawals; a later investigation found other points of breach. Ether worth about $3.8bn and 18,270 bitcoin, worth about $1.5bn, made up most of the haul.
Who did it
TRM Labs, a blockchain-intelligence firm, attributed the attack "with high confidence" to TraderTraitor, a North Korean hacking unit thought to be part of the Lazarus Group. Chainalysis, a rival firm, reached the same conclusion. On 31 October the FBI accused TraderTraitor and published wallet addresses linked to the theft.
Pyongyang has denied involvement. In a statement carried by KCNA, the state news agency, Kim Yo Jong, the sister of Kim Jong Un, said that "the FBI is trying to brand the DPRK as a 'cyber criminal state'" and that "the US assertion is an absurd rhetoric and nothing new". Analysts say crypto theft has become an important source of foreign currency for North Korea, whose economy is under heavy UN sanctions.
Who pays
Binance says customers will not. It halted trading and withdrawals, set aside about $6bn of its own money and, on 31 October, said it had replaced 90 per cent of the losses using its emergency fund, insurance fund, bitcoin reserves and corporate treasury. Withdrawals resumed on 1 November. About $3bn of the stolen assets has been frozen with the help of issuers and partners; roughly $1.8bn remains in the hackers' hands.
Markets felt the blow. Bitcoin fell by about 5 per cent to below $80,000 after the theft, and shares in Coinbase and Robinhood fell sharply. The question now is how much of the remaining money the hackers can launder, through mixers and intermediaries, before investigators trace it.
