#3Business
Record $6.3 billion Binance theft sparks a US–North Korea blame fight
A record theft drained Binance in minutes while Washington and Pyongyang clash over blame.
4 Nov 2026, 08:00 · All sides · Written by Grok
12 sources · 4 countries🇬🇧 🇺🇸 🇨🇴 🇰🇷
- On 29 October 2026, Binance said attackers pulled about $6.3 billion to $6.36 billion off the exchange across 10 different crypto networks, most of it in about 20 minutes.
- The company said it would repay users from its own money.
- US investigators and blockchain firms blamed a North Korean hacking unit; Pyongyang called that a political lie.
How the views differ
State media, independent media and top voices on X
US law-enforcement and crypto-tracing narrative
Specialist firms and the FBI say the theft matches TraderTraitor, an elite North Korean unit also tied to an earlier Bybit hack and described as Lazarus-linked.
They treat the case as state cyber theft meant to raise money, not a random online robbery.
In this account, Binance’s reserves and fast freezes keep users from bearing the loss even though the coins moved in minutes.
- nextgov.com (Ind.)
- trmlabs.com (Ind.)
- decrypt.co (Ind.)
- washingtonpost.com (Ind.)
- cbsnews.com (Ind.)
- en.yna.co.kr (St.)
North Korean state narrative
Through KCNA and Kim Yo Jong, North Korea denies any role and calls the FBI link a repeat accusation meant to stain its image.
The claim is that Washington has not shown direct proof, only blockchain tracing and official statements.
A denial from state media shows what Pyongyang says; it does not, by itself, identify another thief.
- reuters.com (Ind.)
- bbc.co.uk (St.)
- apnews.com (Ind.)
The theft is the firmest fact. Binance reported the amount, the 10 networks, and the roughly 20-minute window, and major outlets carried that account. Its promise to repay users from company funds and SAFU, and the freeze of about $2.85 billion to $3 billion, are also company statements repeated by Reuters. They are specific, but they are not an outside audit. Who took the money is not equally open.
Grey areas. Ask to dive deeper
Grok checks every side again and answers with sources.
Popular questions
Ask anything about this story. It's free with an account, 1 a week.
- June 2026
Campaign targeting Binance employee laptops with malware and fake job offers begins.
Prior to October 2026: TraderTraitor unit linked by investigators to earlier Bybit hack.
Coverage
12 sources · 4 countries
- State-funded 9
- Independent 3
GBUSCOKR
All sources
- decrypt.coUnauthorized withdrawals of about $6.3 billion to $6.36 billion started around 20:05 UTC and were mostly done in about 20 minutes. Decrypt TRM LabsState-funded · Colombia
- TRM Labs (independent)Unauthorized withdrawals of about $6.3 billion to $6.36 billion started around 20:05 UTC and were mostly done in about 20 minutes. Decrypt TRM LabsState-funded
- Binance official announcements (independent/company)Binance said it set aside more than $6.34 billion, including $5 billion in the same tokens taken, using company funds and its emergency reserve, SAFU. BinanceIndependent
- reuters.comPartners including Tether and Circle helped freeze about $2.85 billion to $3 billion. ReutersIndependent · United Kingdom
- therecord.mediaBinance said this was a campaign from June, using malware and fake job offers against employee laptops, not one break-in. The RecordIndependent
- nextgov.comThe FBI confirmed the link and published wallet addresses. NextgovState-funded
- washingtonpost.comSources: TRM Labs (independent) TRM Labs; Chainalysis via Decrypt Decrypt; FBI via Nextgov Nextgov; Washington Post Washington Post; CBS News CBS News; Yonhap YonhapState-funded · United States
- cbsnews.comSources: TRM Labs (independent) TRM Labs; Chainalysis via Decrypt Decrypt; FBI via Nextgov Nextgov; Washington Post Washington Post; CBS News CBS News; Yonhap YonhapState-funded · United States
- en.yna.co.krSources: TRM Labs (independent) TRM Labs; Chainalysis via Decrypt Decrypt; FBI via Nextgov Nextgov; Washington Post Washington Post; CBS News CBS News; Yonhap YonhapState-funded · South Korea
- SourcesKCNA described the US and FBI claims as “absurd rhetoric.” ReutersState-funded · United Kingdom
- BBC News (independent)“The US has made a trite provocation of linking it with the Democratic People’s Republic of Korea again... It is a grave political provocation against the DPRK...” — Kim Yo Jong, via KCNA BBCState-funded · United Kingdom
- SourcesNorth Korea (via KCNA/state media and Kim Yo Jong) denied involvement, calling US/FBI claims “absurd rhetoric,” “trite provocation,” and a political attempt to damage its image.State-funded · United States