Binance Hackers Moved $6.3B Before Assets Could Be Frozen, Report Says
By patricklewis // 2026-11-02
Copy
 
Attackers moved an estimated $6.3 billion out of Binance wallets before the exchange and outside parties could freeze the funds, according to a Cointelegraph report that described a race between the thieves and the firms trying to stop them. TRM Labs said in its own assessment that an attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains on Oct. 29, 2026, most of it in about 20 minutes [1]. The report stated that the transfers unfolded faster than counterparties could respond and that Tether, Circle and other players immobilized around $3 billion of the stolen assets [2]. The report did not specify exact dates for each individual transfer or provide a complete chain of how the funds moved from wallet to wallet. Binance, the world's largest cryptocurrency exchange, has not publicly detailed every step of the incident beyond its own statements, and the company has said it is continuing to work with authorities to determine what happened [3].

How the Transfers Unfolded, According to the Report

Attackers used rapid transactions to push funds across multiple wallets before counterparties could block them, according to the report. TRM Labs stated that the flow of about $6.36 billion left Binance wallets on ten blockchains, with most of it happening in roughly 20 minutes [1]. That pace left little time for exchanges, stablecoin issuers, and blockchain analysts to coordinate freezes. The report cited on-chain data showing billions of dollars moved in a short period, and it noted that the speed of the transfers complicated tracing and recovery efforts. Binance said initial checks suggested an engineer's laptop had been compromised, allowing unauthorized withdrawals, but a subsequent investigation pointed to a more complex attack, according to a BBC account [4]. Security expert Jayant Dave of Check Point told the BBC that the attackers "didn't break the encryption or steal the private keys" and instead "took over the system that tells the keys what to sign" [5]. The scale of the movement was reflected in the frozen totals reported by multiple outlets. Crypto.news reported that Binance's $6.3 billion figure is the company's estimate of the incident's impact [6].

Binance Response and Replenishment

Binance's co-chief executive officer, Richard Teng, said the company is working with the authorities to work out what happened and will cover all losses [3]. Binance has said the losses will be absorbed by the company rather than users. The BBC reported the company's statement: "Binance will absorb the financial impact of these stolen funds, not our users" [7]. The exchange did not comment beyond its public statements in the report, and a Binance representative said the company had nothing further to add. Security procedures and user fund protections were under review, the company said.

What Remains Unclear

Authorities have not announced arrests or full recovery of funds, and investigations into the movement of the $6.3 billion are ongoing, according to the report and public statements. Binance and investigators did not provide a complete timeline of when each transfer occurred, according to the report. The identity of the attackers has been attributed by three analytics firms to North Korean state actors. TRM Labs attributed the attack "with high confidence" to TraderTraitor, which it described as an elite hacking unit operating out of North Korea [11]. The BBC reported that the Lazarus Group, also known as TraderTraitor, was identified "with high confidence" by TRM Labs and Chainalysis [12]. Questions also remain about the mechanism of the attack. Binance described the event as a complex breach, and the BBC reported that a subsequent investigation pointed beyond an initial laptop compromise to a more complex attack [4]. The report stated that investigations into the movement of the $6.3 billion are continuing.

References

  1. North Korea Steals USD 6.36 Billion From Binance in the .... https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
  2. Binance Hack: How Attackers Raced to Move $6.3B - Cointelegraph. https://cointelegraph.com/magazine/binance-hackers-raced-to-move-billions-before-could-be-frozen
  3. Binance hack - who is behind it, is my money safe and what we know so far. https://bbc.com/news/articles/cm5yn8eqg3npo
  4. Crypto giant Binance hit by record $6.3bn hack. https://bbc.com/news/articles/cwe8lp7zy07zo
  5. LIVECrypto giant Binance hit by $6.3bn largest known hack as CEO blames 'compromised' engineer's laptop. https://www.bbc.com/news/live/cqrmynd3042gt
  6. Binance hack: What happened and where the $6.3 billion went. https://crypto.news/binance-hack-what-happened-and-where-the-6-3-billion-went/
  7. Crypto firm Binance covers 90% of losses after $6.3bn hack. https://bbc.com/news/articles/ckpdg3ql4169o
  8. Crypto lender BlockFi blocks withdrawals as FTX declares bankruptcy - NaturalNews.com, November 16, 2022.
  9. The Money Bubble. Turk James Rubino John-1
  10. Trump Pardons Binance Founder Tied to His Crypto Venture. https://thenewamerican.com/us/trump-pardons-binance-founder-tied-to-his-crypto-venture/
  11. North Korean unit likely behind $6.3 billion hack on Binance, blockchain intelligence firm says. https://justthenews.com/nation/technology/north-korean-unit-likely-behind-63-billion-hack-binance-blockchain-intelligence?utm_source=justthenews.com&utm_medium=feed&utm_campaign=external-news-aggregators
  12. Why North Korea's 'elite' hackers are the prime suspect in major Binance hack. 2026-10-31T03:01:07.227Z. https://bbc.com/news/articles/ck9dz3v7z7v3o

Explainer Infographic

Copy