On 29 October 2026, US$6.3 billion worth of digital currency was stolen from Binance, a cryptocurrency exchange, allegedly by the North Korea–linked hacking group TraderTraitor. The exchange hack is the largest-ever cryptocurrency heist, surpassing the $1.5 billion Bybit hack in 2025, with the most affected blockchains being Ethereum and Bitcoin. Approximately $3 billion of the stolen stablecoins have been frozen.
The theft is attributed to TraderTraitor, part of the Lazarus Group, which is associated with the North Korean state and responsible for severe harm and cyberattacks worldwide.
With this theft, if the attribution is confirmed, North Korea would become the country with the largest cryptocurrency reserves in the world. The country is estimated to hold over $20 billion, derived both from these large-scale thefts and from a constant siphoning of funds from digital wallets around the world: a systematic, effective, and continuous drain on cryptocurrencies.
The hack began on 29 October 2026 between 8:05 p.m. UTC, on the XRP Ledger, and 8:20 p.m. UTC, on the Ethereum and Bitcoin blockchains. It took approximately 20 minutes, during which assets worth $6.36 billion were taken out of ten blockchains. The main Ethereum transaction was processed at 4:24 p.m. ET with a combined 64 transfers. Further attacks occurred at 7:05 p.m. ET on Avalanche and Polygon, followed by a final Ethereum transaction at 11:56 p.m UTC. The hackers then moved 17,260 Ether to a new wallet address at 5:15 a.m. UTC the following day.
Of the $6.3 billion stolen, the most affected blockchain was Ethereum, with $3.8 billion stolen, followed by 18,270 Bitcoin, valued at $1.5 billion. Other blockchains affected included TRON, XRP, and Solana; with $628 million, $296 million, and $96 million in assets stolen, respectively.
TraderTraitor used a multi-signature protocol called EIP-7702 to execute the attack on Binance’s hot wallet.
Initially, Binance stated that it believed the attack had been carried out via the compromised laptop of a software engineer, which the hackers used to make unauthorized withdrawals. However, this was merely the most visible part of an attack that had been carefully planned and prepared at least 36 hours in advance.
Following the cyberattack, Binance halted all transactions and suspended withdrawals. The exchange coordinated the freezing of additional assets that were at risk of being stolen, working in collaboration with partners across the blockchain industry; several cryptocurrency companies—including Tether and Circle—blocked approximately $3 billion worth of stablecoins. Binance subsequently revoked the authorizations for its hot wallet at 12:10 a.m. UTC, permanently stopping further thefts.
On 30 October 2026, Binance announced that it would cover all losses resulting from the theft, declaring that user funds were absolutely safe—a claim that is, in fact, far from certain. Following the attack, Bitcoin fell by 5% to less than $80,000.
On 1 November 2026, The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record.