#5Business
Binance confirms about $6.3 billion taken in record crypto theft
Ten blockchains were hit in about twenty minutes; Binance says users are safe.
31 Oct 2026, 07:44 · All sides · Written by Grok
11 sources · 4 countries🇺🇸 🇬🇧 🇰🇷 🇶🇦
- On October 29, 2026, attackers moved about $6.3 billion in cryptocurrency out of Binance wallets.
- Most of it left in roughly 20 minutes, across 10 blockchains.
- Reports call it the largest crypto theft on record, bigger than the roughly $1.5 billion taken from Bybit in 2025, and Binance says customers will not pay for it.
How the views differ
TRM Labs, Chainalysis, and independent outlets reporting their findings
TRM Labs and Chainalysis say the theft was carried out by TraderTraitor, an elite North Korean unit linked to the Lazarus Group.
They cite on-chain and off-chain intelligence and similarities to earlier cases tied to North Korea, including the 2025 Bybit hack.
Other analytics firms saw the same patterns, and major newsrooms treated that as the leading account.
- securityweek.com (Ind.)
- aljazeera.com (St.)
- reuters.com (Ind.)
- cnn.com (Ind.)
- en.yna.co.kr (St.)
- theverge.com (Ind.)
Skeptical users on X, and reporting that stops short of an official culprit
Binance has not named who took the money and says it is cooperating with authorities.
The North Korea link comes from private blockchain firms, not from Binance or a law-enforcement charge.
North Korea routinely denies hacking allegations, and this coverage has no specific reply from Pyongyang or its missions. A few voices go further and treat the episode as something other than an outside hack.
- reuters.com (Ind.)
- cnn.com (Ind.)
- usatoday.com (Ind.)
- koreatimes.co.kr (Ind.)
- @nagimohsen (X)
- View B — @nagimohsen: “Plot Twist: This ‘hack’ is another money laundering scheme for binance.” — [X post]() Open on X ↗
The theft is the solid part of this packet. Binance confirmed that about $6.3 billion left its wallets, several independent outlets reported that figure, and issuers froze about $3 billion, mostly stablecoins. Binance’s own account points first to a compromised staff laptop, then to a wider and more complex breach, with no evidence found that private keys leaked.
Grey areas. Ask to dive deeper
Grok checks every side again and answers with sources.
Popular questions
Ask anything about this story. It's free with an account, 1 a week.
- 2025
Approximately $1.5 billion taken from Bybit in a crypto theft.
Prior to October 2026: Binance maintains a SAFU emergency fund reported at over $1 billion.
Coverage
11 sources · 4 countries
- State-funded 5
- Independent 5
- X / on the ground 1
USGBKRQA
All sources
- Reuters (independent)Binance confirmed about $6.3 billion was stolen; TRM Labs measured about $6.36 billion. Reuters The VergeState-funded · United Kingdom
- The Verge (independent)Binance confirmed about $6.3 billion was stolen; TRM Labs measured about $6.36 billion. Reuters The VergeState-funded · United States
- Al Jazeera (independent/Qatari state-funded)Issuers froze about $3 billion of the stolen assets, mostly stablecoins, including about $1.57 billion by Tether and more than $800 million by Circle. Al JazeeraState-funded · Qatar
- techtarget.comBinance’s first look pointed to a compromised DevOps engineer’s laptop that could reach a service container; it later cited more breach points and a complex attack, and said it found no private-key leak. TechTarget Financial TimesIndependent
- ft.comBinance’s first look pointed to a compromised DevOps engineer’s laptop that could reach a service container; it later cited more breach points and a complex attack, and said it found no private-key leak. TechTarget Financial TimesIndependent · United Kingdom
- securityweek.comTRM Labs said it attributes the attack to TraderTraitor with high confidence. SecurityWeekIndependent
- CNN (independent)U.S. and South Korean outlets reported the North Korea link with the record size of the loss. CNN YonhapState-funded · United States
- Yonhap News Agency (South Korean, independent)U.S. and South Korean outlets reported the North Korea link with the record size of the loss. CNN YonhapState-funded · South Korea
- usatoday.comUSA Today and the Korea Times reported no specific public response from North Korea on this case. USA Today Korea TimesIndependent · United States
- koreatimes.co.krUSA Today and the Korea Times reported no specific public response from North Korea on this case. USA Today Korea TimesIndependent · South Korea
- @nagimohsenOne X user said the event was a money-laundering scheme for Binance, not a hack. @nagimohsenX / on the ground