Somebody just emptied the world’s largest crypto exchange, and the fingers are pointing at Pyongyang. The Binance hack, the largest crypto theft in history, is now being pinned on North Korea. Binance says hackers drained about $6.3 billion from its hot wallets on Oct. 29. Two of the biggest blockchain tracking firms say the fingerprints belong to a Lazarus-linked hacking unit.
What the Binance hack means for your money
If you hold crypto on Binance, here is the short version. Binance says deposits were unaffected and it has frozen about $3 billion of the stolen funds. It also plans to cover the losses from its SAFU emergency fund and company money.
Analyst Sean Farrell of Fundstrat told CNBC the breach does not currently look like a major solvency risk. The real tell, he said, is how fast withdrawals resume and whether outflows stay orderly. For the broader picture, read our piece on the biggest crypto heist ever and the single laptop behind it.
How the Binance heist played out
The speed is the scary part. TRM Labs counted about $6.36 billion moving out of Binance wallets across ten blockchains, most of it in about 20 minutes. That is a bank vault emptied in the time it takes to get a coffee.
As a result, Binance suspended deposits and withdrawals, and the market flinched. Bitcoin fell about 5%, to below $77,000, according to Al Jazeera.
Binance posted that this “was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it.” Co-founder Yi He then added on X that “user funds are safe” and that Binance will cover all hacking losses.
Who is behind the Binance breach
Both TRM and Chainalysis point to TraderTraitor, an elite North Korean unit tied to the Lazarus group. TRM says it has high confidence. Chainalysis says the stolen funds mixed on-chain with money from last month’s Bitget theft, which was also attributed to North Korea.
Here is the catch. Binance itself has not named an attacker, and no government has made an official attribution yet. For now, the North Korea link comes from private analytics firms, so treat it as strong but not final.
It also fits a pattern. In fact, TRM says the Binance theft shares features with the $1.5 billion Bybit hack in February 2025, which the FBI attributed to TraderTraitor. Think small Tornado Cash withdrawals funding an operator wallet, staging well ahead of time, then signatures executed in one burst.
North Korea uses crypto theft to raise foreign currency under heavy UN sanctions, as CBC notes. Pyongyang, meanwhile, keeps up its other provocations, as its latest missile salvo aimed at Seoul shows.
What Binance says went wrong in the exchange attack
Binance’s early findings point to a compromised engineer’s laptop. According to NBC News, that device gave the attacker a path into a service container, where the attacker submitted unauthorized withdrawals. A later review found additional points of breach, though Binance did not say where.
What happens next
Binance expects withdrawals back within about 48 hours, with co-founder Yi He pointing to Sunday, Nov. 1. Once the investigation wraps up, the company promises a detailed technical post-mortem. Meanwhile, tracing and freezing of the stolen funds is still underway with law enforcement, token issuers and analytics firms. For a closer look at the cleanup, see our report on whether Binance can really cover the losses.
A U.S. attribution may still come; the FBI took about a week after Bybit. Until then, check that your withdrawals work, keep your own records, and treat any message about “recovering funds” as a likely scam.
