Binance Hack: FBI Says North Korea Stole $6.3 Billion in 20 Minutes — The Biggest Theft in History
The FBI has named North Korea's "TraderTraitor" hackers as the team behind the record raid on the world's largest crypto exchange.
It took about 20 minutes. When it was over, more than $6 billion in crypto was gone. The US Federal Bureau of Investigation (FBI) said on Saturday, October 31, 2026, that North Korea was behind the hack of Binance, the world's largest cryptocurrency exchange. The attack happened on or about Thursday, October 29.
Binance puts the loss at about $6.3 billion. Blockchain firm Elliptic puts it even higher, at $6.43 billion. Either way, it is the largest theft ever recorded — crypto or not — and more than four times bigger than the $1.46 billion Bybit hack of 2025. Here is what happened, who did it, and what it means for Binance users.
- The FBI blames North Korea and its "TraderTraitor" hacking group for the Binance theft.
- About $6.3 billion left Binance's hot wallets, most of it in roughly 20 minutes, across 10 blockchains.
- Around $3 billion has been frozen with help from stablecoin issuers like Tether and Circle.
- Binance says it set aside $6.34 billion+ of its own money and has already covered about 90% of losses.
- Withdrawals are coming back in phases. Bitcoin dropped nearly 5% and BNB about 10% after the news.
What the FBI Said About the Binance Hack
In a public alert on Saturday, the FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29, 2026. The bureau calls this North Korean cyber activity "TraderTraitor."
The FBI also said it saw the hackers turning stolen coins into Ethereum. It expects them to keep laundering the money through DeFi platforms and "instant swap" services — tools that make funds harder to follow. The FBI, the US Secret Service and IRS Criminal Investigation have asked private companies to help track the money.
Binance co-CEO Richard Teng described it as a "complex attack" in which hackers got into the exchange's hot wallets.
How Hackers Stole $6.3 Billion in 20 Minutes
"Hot wallets" are the online wallets an exchange uses to process everyday deposits and withdrawals. That is where the hackers struck. According to NPR, the attack began at about 4:05 p.m. Eastern Time on Thursday, and the attackers were gone with over $6.3 billion roughly 20 minutes later.
The money moved fast on purpose. Reports say the attackers shifted funds quickly so stablecoin issuers could not freeze them in time, a sign that the process was largely automated. Elliptic found that the attacker set up a "sweeper" contract hours before the raid and even tested it on another wallet about four hours earlier.
⏱️ Timeline of the Binance Hack
Where the Stolen Crypto Went (TRM Labs estimates)
| Blockchain | Approx. value stolen |
|---|---|
| Ethereum | $3.79 billion |
| Bitcoin | $1.47 billion |
| Tron | $628 million |
| XRP Ledger | $296 million |
| Solana | $96 million |
| Total (10 chains) | ≈ $6.36 billion |
Who Are North Korea's TraderTraitor Hackers?
TraderTraitor is the FBI's name for a North Korean state-backed hacking operation. It is closely linked to the well-known Lazarus Group, also tracked as APT38. Blockchain firms such as TRM Labs and Elliptic pointed to North Korea within hours of the attack, and the FBI confirmed it two days later.
This group has a long record. The FBI blamed the same group for the $1.5 billion Bybit hack in February 2025, and North Korean hackers were earlier tied to the roughly $620 million Ronin Network theft and the $100 million Harmony bridge hack. Experts say North Korea, which faces heavy international sanctions over its nuclear and missile programs, uses crypto theft to raise money.
Biggest Crypto Hacks Linked to North Korea
| Target | Year | Stolen |
|---|---|---|
| Binance | 2026 | ~$6.3B |
| Bybit | 2025 | ~$1.46B |
| Ronin Network | 2022 | ~$620M |
| Harmony Horizon Bridge | 2022 | ~$100M |
Can the Stolen Money Be Recovered?
Partly. About half of the stolen assets were stablecoins, and issuers including Tether, Circle, Ripple and World Liberty Financial froze roughly half of what was taken. Binance's own security update put frozen funds at around $3 billion.
The rest is harder. TRM Labs estimates about $2.4 billion has already moved beyond any issuer's reach, which means those coins are very hard to get back. Chainalysis also said money from a September attack on the Bitget exchange is being mixed with funds from the Binance breach.
Is My Money Safe on Binance? What Users Need to Know
Binance says customers will not pay for this. The exchange says it has set aside more than $6.34 billion of its own funds to restore every balance one-for-one. It says it has already replaced about 90% of the stolen tokens. The last 10% are "less liquid" coins that take longer to buy back.
Withdrawals were paused during security checks and are now returning in phases. An analyst at Fundstrat said the breach does not seem to threaten Binance's solvency, and noted its emergency SAFU fund holds about $1.2 billion.
Crypto Market Reaction and Political Fallout
Markets fell hard after the news. Bitcoin dropped nearly 5%, Ethereum lost close to 6%, and BNB — Binance's own token — slid almost 10%, according to AFP.
In Washington, President Donald Trump said the administration was still learning about the attack and would talk to North Korea about it; AFP reported he also cast doubt on Pyongyang's role. North Korea has not commented publicly.
FAQ: Binance Hack 2026
How much was stolen in the Binance hack?
About $6.3 billion, according to Binance. Elliptic estimates $6.43 billion and TRM Labs about $6.36 billion, making it the largest theft in history.
Who hacked Binance?
The FBI says North Korea was responsible. It calls the hacking activity "TraderTraitor," a group linked to the Lazarus Group that also hit Bybit in 2025.
When did the Binance hack happen?
On Thursday, October 29, 2026. Most of the funds were drained in about 20 minutes, starting around 4:05 p.m. Eastern Time.
Will Binance users get their money back?
Binance says yes. It set aside more than $6.34 billion of its own funds, has covered about 90% of losses, and is restoring withdrawals in phases.
Can the stolen crypto be recovered?
Some of it. Around $3 billion has been frozen, mostly stablecoins. TRM Labs says about $2.4 billion has moved out of reach, so full recovery is unlikely.
North Korean hackers pulled off the biggest theft in history in about 20 minutes, taking roughly $6.3 billion from Binance. The FBI has named the TraderTraitor group. Binance says users are covered and withdrawals are coming back, but billions may never be recovered — and the attack shows that even the biggest exchange can be hit.
This article is based on a report by Euronews (يورونيوز).
Read the original report ↗
