Binance Loses $6.3 Billion in Hack, and Crypto Tracing Firms Point to North Korea

Binance, the world's largest crypto exchange, lost roughly $6.3 billion in an attack on its wallets late last week. That is more than four times the roughly $1.5 billion North Korea-linked hackers took from Bybit last year.

The company disclosed the breach on X late Thursday, Oct. 29. It suspended deposits and withdrawals while it investigated.

How the money left

Binance's initial finding is that a DevOps engineer's laptop was compromised. That gave the attacker access to a service container, which was used to submit unauthorized withdrawal transactions.

The exchange said it found "no evidence of any wallet private key leak." Co-CEO Richard Teng said the attack was not a "one-click" action but a complex process.

Lookonchain-style tracking data cited in market reports puts the draw at about $6.36 billion across ten blockchains, emptied in about 20 minutes. Binance's own estimate is "around $6.3B."

A group of crypto firms working with the exchange froze about $3 billion on-chain. The other half was still moving. Chainalysis said it was watching funds shift across multiple blockchains, including bitcoin and ethereum.

Who is blamed

TRM Labs attributed the theft to an elite North Korean hacking unit "based on robust on and off-chain intelligence," saying several features match earlier North Korea-linked heists. Singapore-based Pangolin Intelligence reached the same conclusion. A Chainalysis spokesperson told CNN the firm has "high confidence" North Korea is responsible.

Other reports tie the attack to TraderTraitor, a state-sponsored unit linked to the Lazarus Group. Binance has not made that attribution itself. CNN reported that the exchange's investigation has not attributed responsibility to any individual.

The FBI said Friday it was "aware of the incident" and engaged with public and private partners. North Korea has denied hacking allegations in the past. CNN said it had asked North Korea's UN mission for comment.

The cumulative number

On-chain analyst Darkfost puts Lazarus Group's total crypto theft at $11.87 billion after the Binance hit. He says that equals 45% of North Korea's estimated 2025 GDP, based on Bank of Korea data, and 35% of its gross national income. Darkfost also notes some funds were lost along the way in laundering.

TRM Labs has a higher count: about $12.8 billion across nearly 100 incidents since 2017. It estimates North Korean actors stole $7.4 billion in 2026 alone, which it says is 85% of all value stolen in crypto hacks worldwide this year.

Chainalysis had estimated cumulative North Korean theft at more than $6.75 billion at the end of 2025. The firms use different methods, so the totals do not line up neatly.

The firms agree on the direction. A sanctioned government is collecting billions from a handful of operations, and one 20-minute drain accounts for most of this year's haul.

Binance's response

Binance says it will cover all losses, not its users. Teng said Sunday the exchange had "replenished approximately 95 percent of the impacted assets." The company said it raised $6 billion from its corporate treasury, an insurance fund and a fund set aside for security breaches. It also promised an updated Proof of Reserves once remediation is done.

The run on the exchange was real but limited. Users pulled $3.64 billion over nine hours on Sunday, Nov. 1. Binance said withdrawal volumes then declined and stabilized, while deposits stayed substantial.

Binance says it has more than 335 million users and trades $95 billion in digital assets and derivatives daily.

Co-CEO Yi He said Monday that the priority is making sure the environment is secure. She also took a shot at other platforms, pointing to "fraudulent exchanges that absconded" and saying their ledgers are opaque.

Tim Sun, a senior researcher at HashKey Group in Hong Kong, said the hack "has not yet triggered widespread panic or a massive, concentrated withdrawal." He added that the damage to market confidence "likely extends far beyond the stolen assets," because security worries will affect how market makers and institutions allocate capital.

Washington and Beijing

President Donald Trump was asked about the hack on Oct. 31. "I'm not concerned," he said. "We're learning about it. We don't know if it's North Korea, but if it is, we'll talk to North Korea about it."

China's Foreign Ministry, through spokesperson Mao Ning, said it was unaware of any connection between the Binance incident and the North Korea situation Trump mentioned.

Trump is due at the Asia-Pacific Economic Cooperation summit in Shenzhen, China, on Nov. 18 and 19.

The next concrete items are Binance's promised technical post-mortem and updated Proof of Reserves. Both are still outstanding. So is the fate of the roughly $3 billion that was not frozen, which tracing firms say North Korea will try to cash out through a network of money-laundering operations.

An Oct. 29-30 attack on a single exchange now sits at the center of the question of how much of North Korea's economy runs on stolen crypto.