Cryptocurrency exchange Binance suffered a massive cyberattack on October 29, 2026, with approximately $6.3 billion in digital assets stolen.
The incident is believed to be the largest cryptocurrency theft ever recorded, surpassing the $1.5 billion Bybit hack in February 2025.
Investigators are now examining how the attackers gained access, where the stolen funds went, and whether a North Korean hacking group was responsible.
Here’s what we know so far and what cryptocurrency users should watch for.
The attack targeted cryptocurrency wallets used by Binance to process transactions.
These are known as hot wallets, which remain connected to the internet to support withdrawals and other operations.
According to WIRED’s investigation into the $6.3 billion Binance hack, attackers moved cryptocurrency across multiple blockchains, with most of the theft occurring in approximately 20 minutes.
The speed of the operation surprised researchers because it involved enormous amounts of digital assets moving through different blockchain networks.
Binance temporarily suspended deposits and withdrawals while investigating the breach.
The exchange also began working with blockchain companies and law enforcement to track the stolen assets.
Binance initially reported that the incident may have involved a compromised laptop belonging to a DevOps engineer.
DevOps professionals help manage the technical infrastructure that supports digital platforms.
If attackers compromise a device with sensitive access permissions, they may be able to exploit weaknesses in the surrounding systems.
However, Binance later said its investigation had identified additional points of compromise.
This means the exact attack sequence remains under investigation.
The company also stated that it had found no evidence that wallet private keys were leaked.
A complete technical explanation is expected after investigators finish reviewing the incident.
One name has emerged repeatedly: TraderTraitor, a hacking group linked by cybersecurity researchers to North Korea.
TraderTraitor has been associated with sophisticated cryptocurrency thefts, including attacks targeting exchanges and other financial platforms.
According to Reuters’ reporting on the Binance investigation, blockchain intelligence companies identified similarities between the Binance breach and earlier operations attributed to North Korean hackers.
TRM Labs and Chainalysis have both pointed to TraderTraitor as a likely suspect.
The group has also been associated with the Lazarus hacking network, which has been linked to several high-profile cryptocurrency attacks.
In February 2025, the FBI attributed the $1.5 billion Bybit theft to North Korean actors associated with TraderTraitor.
However, Binance has not officially confirmed who carried out the October 2026 attack.
The current attribution is based on technical findings and intelligence analysis rather than a final determination by authorities.
The scale of the Binance incident is extraordinary.
The Bybit hack in 2025 involved approximately $1.5 billion in stolen cryptocurrency.
The estimated Binance losses are more than four times that amount.
Researchers say the attackers moved funds across multiple blockchain networks, complicating efforts to trace and recover the assets.
The use of different cryptocurrencies also creates challenges because not every token can be frozen by an issuer.
Stablecoins such as USDT and USDC may have mechanisms that allow their issuers to freeze certain assets.
Bitcoin and Ether generally do not offer equivalent centralized freezing controls.
This distinction matters when authorities and cryptocurrency companies attempt to stop stolen funds from moving.
Binance reported that approximately $3 billion in affected assets had been frozen through coordination with blockchain partners.
Freezing assets can prevent attackers from transferring or cashing out certain tokens.
However, frozen funds are not necessarily recovered funds.
Additional legal, technical, and operational steps may be required before assets can be returned.
Investigators continue tracking the remaining cryptocurrency.
The amount ultimately recovered may change as the investigation progresses.
Binance has stated that customer funds remain safe and that the company intends to cover losses associated with the attack.
The exchange has also referenced its emergency protection resources and plans to publish updated information about its reserves.
Still, customers should distinguish between the company’s commitments and the completion of any recovery process.
Users should monitor official announcements for updates about withdrawals, deposits, and account security.
Avoid making financial decisions based solely on unverified social media posts.
Major cryptocurrency breaches often create opportunities for scammers.
Criminals may impersonate exchanges or customer support teams, claiming that users must urgently verify their wallets, recover stolen assets, or claim compensation.
Be cautious of messages offering immediate refunds or asking you to connect a wallet to an unfamiliar website.
To protect yourself:
The PSafe blog explains how malicious links work and how to protect yourself, including common tactics used to steal credentials and financial information.
The Binance breach highlights the importance of strong security controls, even at major cryptocurrency platforms.
As investigators continue tracing the stolen assets, users should rely on verified information, secure their accounts, and remain alert to scams exploiting the news.
Artificial intelligence can help you organize appointments, create to-do lists, and plan your entire week…
You receive a Microsoft Teams meeting invitation. The subject looks professional, the time is scheduled,…
Imagine asking an AI assistant to organize your schedule, find an important document, or summarize…
You're shopping online, find a great deal, and notice a small padlock next to the…
Have you ever received an Android update notification and decided to install it later? In…
A cyberattack targeting Einstein Hospital Israelita, one of Brazil's leading hospitals, has raised concerns about…