Record Crypto Heist Slams Binance

In about 20 minutes, attackers drained roughly $6.3 billion from Binance wallets across ten blockchains, triggering the largest crypto theft on record.

Story Highlights

Binance says a compromised engineer’s laptop enabled access used to push unauthorized withdrawals.
TRM Labs and others attribute the heist to North Korea’s TraderTraitor with high confidence.
About half the assets were reportedly frozen by exchanges and stablecoin issuers, complicating final losses.
The speed, scale, and cross-chain moves exposed weaknesses in exchange hot-wallet defenses.

What Binance Says Happened Inside Its Systems

Binance said its initial probe pointed to a compromised DevOps engineer’s laptop. That access allegedly let an attacker reach a service container and submit unauthorized withdrawal transactions. Company posts described a complex, multi-point breach with a first wave of transfers in minutes and a later second wave. Binance framed the laptop vector as part of the intrusion chain while it continued to investigate added breach points and containment steps.

Reporting also described how the attacker manipulated approval paths to move funds outside normal controls. Binance’s public notes focused on service access and unauthorized withdrawals, not on broken cryptography. That distinction matters. The theft did not crack the math behind signatures. It appears to have bypassed operational safeguards around keys and approvals. That is the soft spot for many exchanges that rely on hot wallets for speed and customer convenience.

How $6.3 Billion Moved So Fast on Public Blockchains

TRM Labs tracked about $6.36 billion flowing from Binance wallets across ten blockchains. Most transfers happened within roughly twenty minutes, a window that limited real-time response. Analytics firms identified attacker-controlled wallets and mapped the cross-chain hops. Later, a second wave of unauthorized transfers followed. These traces are visible on-chain, allowing freezes where issuers or platforms could act, and giving investigators clear transaction trails to follow.

Stablecoin issuers and partner platforms reportedly froze around half of the affected assets. That included tokens where issuers can block addresses or reissue to rightful holders. Freezing slows laundering but does not settle recovery. Assets moved into coins that lack freeze functions are harder to claw back. The emerging picture is a tug-of-war: rapid, automated theft versus targeted freezes and exchange coordination to contain losses and track flows.

Why North Korea’s TraderTraitor Is the Prime Suspect

TRM Labs stated with high confidence that TraderTraitor, a North Korea-linked unit, executed the attack. Elliptic and Chainalysis were separately reported as reaching the same broad judgment. Their view cites on-chain behavior, prior case overlaps, and other intelligence. This aligns with a multi-year pattern where North Korea-linked groups are frequently blamed for major crypto raids to fund the regime’s programs, according to analysts and past advisories.

FBI confirms it: North Korea's TraderTraitor stole $6B+ from Binance — the biggest crypto theft ever. The loot is being converted into ETH and washed through DeFi swaps. Binance refilled 90% from its own funds — not recovered. ~$3B frozen. Withdrawals reopen Nov 1. $BTC $ETH pic.twitter.com/atBzYBre85

— Plain Market Daily (@PlainMarketD) October 31, 2026

That attribution sits beside Binance’s technical account. The two claims answer different questions. The compromised laptop and service container describe the entry and execution path. The TraderTraitor label identifies the likely operator. Together, they sketch a familiar playbook: social or endpoint compromise, quick access to hot-wallet processes, burst withdrawals across chains, then mixing and swaps to blunt freezes. Analysts say this case fits that profile at record scale.

Why This Matters for Everyday Users and Markets

Record-speed outflows forced platforms and issuers to freeze assets and tighten checks. That response helps, but it also shows central choke points in a system many thought was decentralized. Users want fast withdrawals. Exchanges keep hot wallets to serve that need. Attackers target those hot paths, not the math. Until controls match the stakes, a single endpoint breach can ripple into billion-dollar losses and broad market stress, as coverage noted after the incident.

Limits of What We Know So Far

Public reporting does not include a full forensic chain from the compromised laptop to transaction signing. Binance’s account evolved to include additional breach points. Analysts cited strong indicators linking the operation to North Korea, but their confidential methods are not fully public. Those gaps do not change two established facts: billions moved in minutes, and a large share was frozen in the aftermath while recovery efforts continued.