It took roughly twenty minutes. Late on Thursday, October 29, 2026, attackers drained an estimated $6.3 billion in digital assets from the hot wallets of Binance, the world’s largest crypto exchange. Analysts rank it as possibly the largest robbery in financial history, digital or not. Days later, a clearer picture is emerging, though key questions remain open.
Who is behind it
On Saturday the FBI publicly blamed North Korea. The bureau said the theft was the work of a state-backed unit it calls TraderTraitor, the same group it tied to the $1.5 billion Bybit hack last year. US cyber agency CISA describes TraderTraitor as active since at least 2020 and considers it part of the wider Lazarus Group. Blockchain analysts at TRM Labs and Chainalysis had already pointed in the same direction, citing familiar patterns: a control wallet seeded with modest sums routed through the Tornado Cash mixer, long preparation before the strike, and pre-signed transactions fired off in a single burst.
According to the FBI, the attackers have been converting the loot mainly into ether and are expected to launder it further through DeFi and instant-swap services. The bureau published more than 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address, asking exchanges, node operators and analytics firms to block any transactions linked to them. Chainalysis warns that tens of thousands of addresses could be used in the weeks ahead. North Korea has long denied running such operations and stayed silent when asked about the accusation.
What it means for customers
Binance paused deposits and withdrawals after the attack, then began reopening them in phases on Sunday, starting with Bitcoin, followed by Ethereum, BNB Smart Chain and some stablecoins. The exchange says users will not bear the loss. It reports having replaced the bulk of the stolen tokens with its own money, drawing on its SAFU user protection fund, a slice of the reserve that backs its futures business and money from its own balance sheet. Figures vary between updates: Binance first spoke of about 90 percent covered, Reuters later cited 95 percent. Together with industry partners, the exchange has also been working to freeze affected funds and said it had tracked down about $3 billion of them by Friday. Still, covering the assets is not the same as recovering them from the thieves. The tokens still missing trade thinly, so replacing them will take more time.
Still unconfirmed: how the attackers got in. Binance initially mentioned a possibly compromised laptop of a DevOps engineer, but co-CEO Richard Teng later described a more complex attack. A full technical account has not yet been published.
