The FBI attributed the $6.3 billion Binance crypto heist to North Korean state hackers, sparking denials from Pyongyang amid ongoing asset recovery efforts.
South Korean President Lee Jae-myung has directed officials to look into creating a cybersecurity task force. A wave of hacking incidents at financial firms and a massive cryptocurrency theft linked to North Korea have raised alarm over the country's digital defenses.Lee instructed on Tuesday, Nov. 3, 2026, during a Cabinet meeting at Cheong Wa Dae in Seoul. The proposed task force would focus solely on strengthening online security.
Cybersecurity Task Force and North Korea's Binance Heist
The directive follows a string of attacks on domestic financial companies that exposed customer data. The most recent targets were Mirae Asset Global Investments, cryptocurrency exchange Bithumb, and Daishin Securities.It also comes after the hacking of Binance, the world's largest crypto exchange, in which more than US$6 billion in cryptocurrency was stolen. The U.S. Federal Bureau of Investigation (FBI) has since attributed the theft to North Korea, which gives the incident a national security dimension beyond financial crime.Lee said cyber threats have grown severe enough to endanger the national economy, national security and the daily lives of ordinary citizens. He called for "a comprehensive prevention system" to address them.According to the president, hacking methods are becoming more sophisticated and widespread, driven partly by advances in artificial intelligence (AI). He said this trend is exposing clear limits in the systems currently used to maintain security.
A Possible "Czar Agency" Amid North Korea Threats
Lee's plans go further than a single task force. He stressed the need for talks on setting up a pan-government agency responsible for cybersecurity across both the public and private sectors.He specifically told officials to "proactively consider the formation of a cybersecurity czar agency" that could act as a strong and effective control tower for security management.The president also ordered officials to thoroughly fix security weaknesses at major state institutions and key national infrastructure, naming information communications, energy, and finance. Because hackers tied to North Korea have repeatedly targeted financial assets, the finance sector is a particularly pressing concern.
Social Media Limits for Teens Also on the Agenda
Cybersecurity was not the only digital issue raised at the meeting. Lee also called for quick discussions on the government's plan to restrict adolescents' use of social media."The harmful effects (of social media on teenagers) appear to be greater than what we think," Lee said.The government is pursuing measures to limit social media sign-ups by young teens and to restrict their use of certain services, including algorithm-based ones. The goal is to shield adolescents from the harms of social media.Lee told Kim Jong-cheol, chairman of the Korea Media and Communications Commission, to "conduct relevant discussions thoroughly and promptly." He pointed to similar efforts already under way in Europe, Australia and Canada.Kim replied that the plan should be pursued on the basis of social consensus. He said the commission intends to gather public input and finalize the measures in the first half of next year.Officials will now weigh whether to form a cybersecurity task force and a broader czar agency. Their decisions will shape how South Korea responds to escalating digital threats, including attacks attributed to North Korea.
The FBI blames North Korea for stealing $6 billion from Binance and urges crypto firms to block transactions linked to the stolen funds.
The FBI has named North Korea as the party behind the theft of more than $6 billion in virtual assets from the crypto exchange Binance, on or about October 29, 2026. The bureau published its findings in a public alert. The FBI specifically blames the North Korea-linked APT “TraderTraitor,” also tracked as Lazarus Group and APT38.
Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It was the first to attribute the attack to TraderTraitor, and Chainalysis also said it’s highly confident in that finding.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as “TraderTraitor.”” reads the FBI’s statement.
“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”
Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys.
The FBI, along with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), has spotted TraderTraitor actors turning the stolen assets mostly into Ethereum (ETH). The agencies expect the next step to be more laundering, by swapping the funds through DeFi and instant swap services as the actors prepare them for later stages. Instant swap services are aptly named.
The alert is aimed at private companies as well as law enforcement agencies. The FBI, USSS and IRS-CI are asking several types of businesses to help stop the money laundering. These include THORNode operators, who support the THORChain network, RPC node operators, who provide apps with access to blockchains, instant crypto exchanges, DeFi platforms, blockchain analytics companies and other crypto service providers.
The request is clear: these companies should block any transactions involving the wallet addresses used by TraderTraitor, including funds that can be traced back to them. According to the FBI, these addresses have received stolen funds and are controlled by North Korean attackers or are closely linked to them. The full list of addresses is included in the alert.
If you run any of these services, the first job is to check your blocklists against that list. The second is to look at transaction flows that touch those addresses indirectly, since the FBI says to block anything “derived from” them, not just direct transfers. Blockchain analytics firms are named for a reason, because tracing derived funds is their work.
The FBI says it’s committed to protecting the virtual asset community by identifying, mitigating and disrupting North Korea’s illicit cybercrime and virtual asset theft.
“The FBI maintains its commitment to protecting the virtual asset community by identifying, mitigating, and disrupting North Korea’s illicit cybercrime and virtual asset theft activities.” concludes the report. “If you have any information to provide, please contact your local FBI field office or FBI’s Internet Crime Complaint Center at ic3.gov.”
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
“On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” TRM said. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.”
Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.
The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t.
Below is the link to my interview regarding the Binance case for Italian state television.
FBI links 628 crypto wallet addresses to North Korea’s TraderTraitor after the $6.3 billion Binance hack, asking services to block transfers involving stolen funds.
Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts.
Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurrency exchange had linked the theft of about $6.3 billion to a DevOps engineer’s compromised laptop. Billions had moved out of wallets linked to the exchange.
According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet.
“Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block reports. “Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.”
Coinbase executive Conor Grogan initially estimated that the total value of the movements could reach $5.8 billion.
Those figures came from blockchain tracking and differing estimates, so they didn’t necessarily show the amount stolen.
Binance pointed out that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered.
The company said its user funds were “completely safe.”
“Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”
That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact.
“Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.” Binance Co-CEO Richard Teng explained.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.”
I want to speak to you directly about what happened.
Bottom line – your money is safe, and we're covering every loss.
Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a…
Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys.
Binance also said it had found “additional points of breach” and was still investigating. Co-CEO Richard Teng said the investigation had not identified anyone responsible. After the attack, Binance suspended deposits and withdrawals to carry out security checks, cancelled the permissions linked to the affected address, and began working with blockchain analysis firms and law enforcement to track the stolen funds.
Binance says it will cover all losses using its SAFU fund and its own money, and that customer funds are safe. The company also plans to publish an updated Proof of Reserves once it has completed the recovery work. This commitment does not replace a detailed technical explanation or independent confirmation of the full impact of the attack.
Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It attributes the attack to TraderTraitor, a North Korean state-backed unit also tracked as Lazarus Group and APT38, and Chainalysis says it’s highly confident in that finding.
Our investigators observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance.
We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance. https://t.co/xj9dQYcbKr
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
“On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” TRM said. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.”
Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.
The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t.
Hot wallets help explain how this type of theft can happen. They store cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals quickly. But this also makes strong security controls essential. Investigators still need to determine who initiated the transfers, whether they were authorized, whether attackers gained control of the wallets, and whose funds were stolen.
Binance co-founder Changpeng Zhao, who no longer runs the company, said the activity looked like a hack and expected customers to be fully compensated. Large transfers alone do not prove a cyberattack, but the findings that emerged later provided strong evidence of a breach.
Customers also need to be careful. Attackers often exploit the confusion after a major incident by spreading fake announcements, pretending to be support staff, and directing users to fraudulent websites. Use only Binance’s official channels, avoid unexpected links, and never share passwords, authentication codes, or wallet recovery phrases in response to unsolicited messages. Security teams should also watch for phishing emails that use the incident to pressure employees into verifying their accounts.
The lesson goes beyond Binance. A public blockchain records every transaction, but it cannot show who authorized it or how attackers gained access. Blockchain transparency does not guarantee operational security.
Binance, the world's largest cryptocurrency exchange, said on Thursday that a "security incident" on its platform affected roughly $6.3 billion worth of assets. It is one of the largest security events in the crypto industry so far, though the exchange said close to $3 billion of the affected funds had already been frozen on-chain.Stablecoin issuers moved quickly after the data breach at Binance. Tether said it had frozen more than 1.567 billion USDT linked to the incident, and Circle froze 800 million USDC. The Arbitrum Security Council also reportedly executed a transaction to freeze about $30.5 million connected to the Binance exploit.
How the Binance Data Breach Happened
According to the exchange, early findings point to a compromised employee device. Initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said in an update.The statement, titled "Security Incident Update," was published on October 30, 2026, at 07:53. It said the company had found no evidence that any wallet private key was leaked. Binance added that it would release a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
Who Will Cover the Losses
Binance said it will cover all losses from the cyberattack on Binance using its Secure Asset Fund for Users (SAFU) and the company's own funds. "User funds are safe," the exchange stated. It also said it had worked with blockchain partners to freeze the affected assets. Once remediation is complete, it plans to publish an updated Proof of Reserves.
Immediate Steps Following the Binance Data Breach
As an immediate precaution, the exchange said it has:
Temporarily suspended deposits and withdrawals while security checks are completed;
Revoked the affected address authorization;
Engaged law enforcement and blockchain intelligence partners to trace and recover the funds.
The company said its teams are working around the clock to resolve the issue. "We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice," Binance said.The exchange asked users to rely only on official Binance channels for updates and to contact Binance Customer Support with any further questions.
Withdrawals Expected to Resume Within 48 Hours
In a later update, Binance said it expects withdrawals to resume in 48 hours, after its team "completes a security revamp of the withdrawal service and its related addresses."Until then, users cannot move funds on or off the platform. Binance has not yet said how the attacker gained access to the engineer's laptop. The company has said those technical details will be in its upcoming post-mortem on the Binance data breach.
Binance probes suspicious crypto transfers worth up to $5.8 billion as Tether and Circle freeze $1.79 billion in stablecoins linked to the activity.
Binance is investigating a potential security incident after billions of dollars in cryptocurrency moved from wallets linked to the exchange on October 29. The transfers raised concerns about a possible hack, while Tether and Circle moved to freeze stablecoins linked to the suspicious activity. The full scope of the incident remains unclear, and the reported outflows shouldn’t automatically be treated as confirmed losses.
According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet.
“Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block reports. “Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.”
Coinbase executive Conor Grogan estimated that the total value of the movements could reach $5.8 billion.
Binance acknowledged the reports and said its security team was investigating. The company had not publicly confirmed a breach in the initial reports, making it important to distinguish between suspicious transactions and a verified compromise.
“We are aware of reports of a potential security issue and we are actively investigating.” He wrote in a post on X. “Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”
We are aware of reports of a potential security issue and we are actively investigating. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should…
This statement, reported by The Block, reflects the company’s position at the time. Binance also urged users to be cautious of unofficial messages and links, a relevant warning whenever a major security incident attracts public attention.
Blockchain records showed large transfers from Binance-linked hot wallets to a wallet that wasn’t previously identified as belonging to the exchange. Hot wallets hold cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals and other transactions quickly. Their online availability also makes their security controls particularly important.
The transfers involved Ethereum, stablecoins and other cryptocurrencies. Some funds were later moved to additional wallets, making it harder to track all the transactions.
Investigators must determine who initiated the transfers, whether they were authorized and whether an attacker gained control of the wallets. They also need to establish whether the funds belonged to customers or Binance itself.
Large transfers alone don’t prove a hack. However, unusual movements involving large amounts of cryptocurrency require immediate investigation.
One of the most significant developments was the response from the companies behind two major stablecoins, USDT and USDC. According to The Block and Forbes, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports.
The figures subsequently changed as the investigation developed. Tether CEO Paolo Ardoino later said the company had frozen more than $1.567 billion in USDT linked to a potential Binance exchange hack. These amounts reflect reported actions at different points in time and shouldn’t be combined without checking whether they refer to distinct assets and addresses.
Tether froze more than 1.567B USDT related to a potential Binance exchange hack.
Protecting the industry and our partners is our main priority.
The freezes demonstrate an important feature of centralized stablecoins: their issuers can restrict transfers from addresses they control through their token contracts. This can help contain suspected theft, but it doesn’t provide the same control over assets such as Ether or Bitcoin. Nor does freezing a balance guarantee that every transferred asset can be recovered.
The incident also highlights a practical tension in crypto security. Stablecoins offer the convenience of blockchain transfers, but their centralized issuers retain powers that can make a difference during an investigation.
Binance maintained that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered.
The company said its user funds were “completely safe.”
“Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”
That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact.
A security investigation must establish more than whether an exchange can cover a potential loss. It should determine how the activity was authorized, whether credentials or signing mechanisms were compromised, which systems were involved and whether the attacker retained any access.
For customers, the immediate priority is to avoid becoming a secondary victim. Attackers often exploit uncertainty around a major incident to distribute fake announcements, impersonate support staff and direct users to fraudulent websites. Users should rely on official Binance communication channels, avoid unexpected links and never disclose passwords, authentication codes or wallet recovery phrases in response to unsolicited messages.
Security teams should also watch for phishing emails that use the incident to demand urgent account verification. Attackers may exploit the situation to launch a separate scam.
The key lesson is that blockchain transparency does not guarantee operational security. Public ledgers show transactions, but they don’t reveal who authorized them, how attackers may have gained access or whether an exchange’s internal security controls failed.
As the investigation continues, it’s important to distinguish between reported transfers, confirmed theft and funds that can be recovered. The figures may change as analysts trace more wallets and stablecoin issuers take further action.
.kadence-column482616_9de20c-07 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{background-color:#ffe5e5;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column482616_9de20c-07{position:relative;}@media all and (max-width: 1024px){.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}
In this article
Attackers stole $6.3 billion from the Binance cryptocurrency exchange
Binance says user funds are safe, but watch out for fake support or recovery offers from scammers
Users should check their accounts and use official Binance channels.
Binance says a security incident affected approximately $6.3 billion in cryptocurrency. Its initial investigation points to a compromised DevOps engineer’s laptop as a possible entry point.
The exchange says it has frozen around $3 billion with help from blockchain partners. It has promised to cover all losses using its emergency fund and company funds. Binance is reportedly the largest cryptocurrency exchange by daily trading volume.
What happened?
In an update on October 30, Binance said attackers may have used a compromised laptop belonging to a DevOps engineer to access a service container and submit unauthorized withdrawal transactions. The company said:
“We have found no evidence of any wallet private key leak.”
This doesn’t mean that one employee could simply transfer billions of dollars. Binance co-CEO Richard Teng told BleepingComputer the attacker did not simply use one engineer’s permissions. The incident involved a more complex process, rather than a single “one-click” action. Binance also said investigators had identified additional breach points.
Blockchain intelligence firms TRM Labs and Chainalysis have linked the theft to TraderTraitor, a North Korean hacking group associated with previous cryptocurrency thefts. TRM Labs estimates that about $6.36 billion left Binance wallets across ten blockchains, with most of it moving within about 20 minutes.
What should Binance users do?
Binance says approximately $3 billion has been frozen on-chain, while blockchain analysts have reported somewhat different totals. For now, those figures should be treated as developing estimates rather than a final accounting of recovered funds or the exchange’s ultimate losses.
Binance.com users (Binance.US was not affected) should check their accounts, avoid follow-up scams, and respond quickly if they spot signs of a separate compromise.
Go directly to official updates. Open the Binance app or navigate to its support site yourself. Avoid logging in through unexpected messages claiming that you must urgently verify your account or claim compensation. Binance has asked customers to rely on official channels.
Review your account and report anything unexpected. Check your transaction history and account security settings. If you find activity you do not recognize, contact Binance through its official support service. Binance’s support center includes options to disable an account and reset a password or two-factor authentication.
Never give anyone your authentication codes. Treat requests for login codes as a warning sign, even if the person claims to be helping with the incident.
Preserve evidence if you lose money to a related scam. Keep messages, wallet addresses, transaction details, and information about anyone offering recovery services.
Binance probes a DevOps engineer’s hacked laptop after a $6.3 billion theft linked by researchers to North Korean hackers, and promises to cover all customer losses.
Binance investigates a $5.8 billion crypto theft, with $3 billion in assets frozen. The exchange says user funds are safe as investigators trace funds.
See how stablecoins, tokenized stocks and fractional investing lower costs and expand global access to US markets through modern financial super apps worldwide.
Entrar
BREAKING: The Binance hack has grown to about $5.6B drained across Ethereum, Bitcoin and Tron, on-chain trackers say. 
(@paoloardoino) 
