On 29 October 2026 at 20:05 UTC, an attacker drained approximately US$6.36 billion from Binance wallets across ten blockchains — most of it within 20 minutes — making it the largest cryptocurrency theft on record, roughly four times the US$1.5 billion Bybit heist of February 2025. Binance said the access chain began with a DevOps engineer's compromised laptop, letting attackers submit unauthorised withdrawal transactions through a service container; the exchange has found no evidence of a leaked private key and stressed the operation was "not a single one-click action". Blockchain analysts TRM Labs and Chainalysis attributed the heist to TraderTraitor, the North Korean state-backed unit also tracked as Lazarus Group and APT38, the latter "with a high degree of confidence". Stablecoin issuers and networks froze roughly US$2.7 billion (Tether, Circle, Ripple, World Liberty Financial, Arbitrum's Security Council), but the attacker had moved perhaps US$2.4 billion into ETH and BTC — more than 420,000 ETH and 18,270 BTC — beyond issuers' reach. Binance has suspended deposits and withdrawals, promised to make users whole from its SAFU reserve fund, and is working with law enforcement on recovery.
| Attribute | Detail |
|---|---|
| Sector | Financial Services |
| Date | 2026-10-31 |
| Source | BleepingComputer |
| Reliability | Tier 2 |
| Breach classification | Confirmed breach |
Escalation — FBI links US$6.36 billion Binance crypto heist to North Korea's TraderTraitor (2026-11-01)
The FBI published a security alert attributing the theft of more than US$6 billion in virtual assets from Binance on or about 29 October 2026 to North Korea, naming the TraderTraitor group also tracked as Lazarus, Jade Sleet and APT38. The formal attribution follows the blockchain-intelligence firms TRM Labs and Chainalysis, which had already linked the heist to TraderTraitor with high confidence. The attackers took approximately US$6.36 billion across ten blockchains, most within 20 minutes, after Binance said a compromised DevOps engineer's laptop let them reach a service container and submit unauthorised withdrawals; the FBI said the funds are being converted primarily to Ethereum and expects further laundering through DeFi and instant-swap services. The FBI, Secret Service and IRS Criminal Investigation asked virtual-asset service providers to block transactions tied to the campaign and published 628 addresses used to launder the proceeds — 608 Ethereum, 19 Bitcoin and one Solana. TraderTraitor's record includes Bitget (US$387.5m, September 2026), Drift (US$280m, April 2026), Bybit (US$1.5bn, February 2025) and DMM Bitcoin (US$308m, 2024).