North Korean hackers stole $6.3 billion from Binance, US agencies say

Crypto firms have frozen about $2.7 billion of the stolen funds. Binance says user funds are safe and it will cover all losses.

3 November 2026

A figure drains coins from an open vault through tangled leaking pipes into a bottomless hole while other hands seal chains and spigots — Illustration generated with AI.

North Korean hackers stole more than $6.3 billion from Binance, the FBI and U.S. Secret Service said on Thursday. The United States agencies called it the largest crypto theft on record, bigger than the $1.5 billion Bybit hack in February. Binance said user funds are safe and the company will cover all losses from its SAFU fund and its own money.

Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion of the stolen funds, according to BleepingComputer. Arbitrum's Security Council, a group that protects the Arbitrum blockchain network, also froze 8,426 ETH and 74.6 million ARB, bringing the blocked total to about $2.7 billion. But the attacker still holds more than 420,000 ETH and 18,270 BTC. That is about $2.4 billion, according to BleepingComputer. No issuer can reach those coins. The frozen sums sit with the four issuers and Arbitrum's Security Council.

Binance suspended withdrawals as an immediate precaution while it ran security checks. The company said it froze affected assets with blockchain partners and put about $3 billion on-chain out of the attackers' reach. The FBI, the Secret Service and the IRS have asked parts of the crypto industry to block transactions with the addresses used to launder the money by the TraderTraitor group, the hackers blamed for the theft. The agencies named the groups they want help from: THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers.

Binance said the attacker got in through the laptop of a compromised DevOps engineer. From there, the company said, the attacker reached a service container and sent unauthorised withdrawal orders. Deposits are unaffected and work as normal, the company said in an update on October 30. Blockchain analytics firm TRM said the attacker moved about $6.36 billion across ten blockchains on October 29. Most of it moved in about 20 minutes starting at 20:05 UTC.

Recovery of the rest is far from sure. About half the stolen money has been moved so many times that recovering more will be incredibly difficult, said Cynthia Kaiser. North Korea uses stolen money to fund its weapons programme, she said. Pyongyang rejected the accusations: Kim Yo-jong called the FBI's claims absurd rhetoric that brings nothing new, in a statement carried by KCNA.