The FBI said late Saturday, October 31, that North Korea was responsible for the theft of more than $6 billion in digital assets from Binance, the crypto exchange that TechCrunch describes as the world’s largest. Binance puts the loss at about $6.3 billion, taken from its hot wallets, and CNBC calls it the largest crypto theft on record. The exchange said Saturday that it had restored backing for roughly 90% of the stolen assets, and it began reopening withdrawals in phases on Sunday, November 1.

What happened

CNBC reports that Binance announced the theft on Thursday, October 29, and the FBI dates it to on or about that day, according to Euronews. TechCrunch reported that same day that withdrawals had been paused on some blockchains. Binance then suspended all deposits and withdrawals while it investigated. Blockchain analytics firm TRM Labs told TechCrunch the theft itself took about 20 minutes.

Binance’s first public account, posted on X and relayed by TechCrunch, said its initial investigation found that attackers had targeted a compromised engineer’s laptop. That access, the company said, let an attacker reach a service container and submit unauthorized withdrawal transactions. CNBC adds that the laptop belonged to a DevOps engineer. Binance also said it had seen no evidence that its private keys leaked, which would have given the attacker something close to full control of its crypto.

That explanation has since been qualified. According to CNBC, co-CEO Richard Teng later said the attack involved a more complex process than the misuse of a single engineer’s permissions, and CNBC describes the exact method as still unclear. TechCrunch notes that it is not known how the laptop was compromised, and that such incidents often begin with tampered open-source components or malware hidden in apps and games that steals passwords and session tokens. It also says Binance will face questions about why one employee’s machine could reach systems that control billions of dollars. Binance did not answer TechCrunch’s emailed questions, including whether anyone had audited its network before the attack.

Who investigators blame

TRM Labs was the first to point at North Korea, according to CNBC. The firm said the theft resembles the 2025 Bybit hack and an April 2026 hack of KelpDAO, and gave three technical reasons: small withdrawals from the Tornado Cash mixing service that funded an operator wallet, staging that began well before the theft, and signatures collected in advance and then executed in one burst. In its words, “Several features of this attack match earlier North Korea-linked heists.”

TechCrunch reports that TRM ties the activity to a group known in the industry as TraderTraitor, a North Korean cell that concentrates almost entirely on stealing crypto from large companies and exchanges. Elliptic, another blockchain security firm, also named North Korea, TechCrunch says, because some of the stolen funds reached a wallet that had been used in an attack on the exchange Bitget earlier in 2026, which took $351 million. CNBC separately reports that TRM Labs and Chainalysis both link the hack to TraderTraitor.

The FBI’s statement, as summarized by Euronews, says North Korean actors it calls TraderTraitor were behind the theft and that it has seen them converting the stolen assets into Ethereum. The agency expects the funds to be laundered further through decentralized finance services and instant swap services. Euronews adds that the US Cybersecurity and Infrastructure Security Agency describes TraderTraitor as a state-sponsored North Korean hacking group linked to crypto thefts since at least 2020, and as believed to be part of the Lazarus Group. None of the articles reviewed for this report includes a response from North Korea.

Who covers the loss

Binance says its users will not bear the cost. In a post quoted by CNBC, the company wrote: “Binance will absorb the financial impact of these stolen funds, not our users.” CNBC reports that the money is coming from the Secure Asset Fund for Users, known as SAFU, a portion of Binance’s Futures insurance fund, and its corporate treasury.

The 90% figure needs careful reading. CNBC stresses that it does not mean 90% of the stolen funds were recovered from the attacker; it means Binance has restored backing for that share of the affected assets. Bloomberg Línea’s headline says Binance has recovered 90%, and its report says the exchange had covered 80% in an earlier update and has been recovering tokens that the hackers moved, including bitcoin, Zcash, USDT and USDC. Both accounts agree that the remaining tokens are harder to replace.

According to CNBC, ten assets are now fully backed: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 10% or so involves tokens outside Binance’s top ten, which the company calls less liquid and slower to source in the amounts required. Binance says it will keep buying them on the market and over the counter until every token is fully covered. On Sunday it reopened withdrawals starting with the bitcoin network, then restored them on the Ethereum network and BNB Smart Chain, CNBC reports. TechCrunch adds that Binance has promised an updated proof of reserves once remediation is complete.

The race to freeze the money

Binance spokesperson Andie Cooper told TechCrunch on Friday that industry partners had frozen about $3 billion. CNBC reports the same estimate and says roughly $3 billion remained with the hackers. TechCrunch cites security researchers who say about half of the stolen crypto was frozen as it moved across blockchains. Circle, which issues the USDC stablecoin, and Tether, which issues USDT, moved to freeze affected funds, CNBC says, and frozen tokens can in principle be destroyed and reissued, with the replacements eventually returned to Binance through a legal government entity.

The attackers appear to have moved fast to get ahead of those freezes. TRM Labs told CNBC that they sold USDT to market makers and borrowed ether against it, an approach that is harder to stop because ether cannot be frozen the way a stablecoin can, and the lender is left holding the stolen stablecoin. CNBC adds that stablecoins swapped into assets such as bitcoin or ether cannot be frozen either.

Chainalysis chief executive Jonathan Levin told CNBC that his firm had not seen mixer services used so far, but had seen laundering patterns it had not encountered before. Funds were being circulated repeatedly among addresses, sometimes returned to earlier wallets, with automation doing much of the work, and many had moved to different addresses on the Tron blockchain. Levin and TRM’s Ari Redbord both said North Korean hackers increasingly rely on Chinese money laundering organizations to turn crypto into cash. Redbord described the effort as a race against time, and Levin said each step away from the original theft reduces the chances of seizure.

Why it matters

The size of the theft puts it in a different class from earlier incidents. The FBI said in February 2025 that North Korea was responsible for the theft of about $1.5 billion from the exchange Bybit on or about February 21 of that year, according to BleepingComputer. TechCrunch gives the Bybit figure as $1.4 billion and calls it the second-largest heist on record, so the two outlets differ slightly on that amount. Either way, the Binance loss is more than four times as large.

Binance has been through this before at a far smaller scale. In May 2019 it said hackers took 7,000 bitcoin, about $41 million and roughly 2% of its bitcoin holdings, and it covered the loss from a secure asset fund while suspending deposits and withdrawals, Al Jazeera reported at the time. Lens analysis: the 2026 theft is roughly 150 times the 2019 figure, a measure of how much the sums involved have grown.

The Bybit case also began with a compromised machine. BleepingComputer reports that preliminary post-mortems traced it to a Safe{Wallet} developer’s computer, which gave attackers access to a Bybit account. Lens analysis: in both cases the reported entry point was a person’s device rather than a flaw in the underlying blockchain, which is consistent with TechCrunch’s question about how much access one engineer’s laptop should carry.

TechCrunch adds the policy background. North Korea is cut off from the US and global financial system over its nuclear weapons program, and researchers say stealing crypto is its main way of raising money for that program. Lens analysis: this is why the FBI’s attribution matters beyond one exchange, since it frames the theft as a state-backed operation rather than ordinary crime.

What to watch

Several questions remain open. Binance has not said how the attackers got in beyond its early description and Teng’s later qualification, and it has not published the updated proof of reserves it promised. The roughly 10% of the loss that is still not backed will depend on how quickly Binance can buy less liquid tokens. The share of the stolen money that is ultimately frozen or seized, as opposed to replaced from Binance’s own funds, is also unknown.

The FBI expects further laundering, and analytics firms say they are tracking the funds around the clock. This suggests the ability to freeze more depends on whether the attackers keep using assets that issuers can block. The FBI’s statement itself was not available to Lens, so its content here is as reported by Euronews and CNBC.

Sources

Image: Cryptocurrency logos.jpg by voytek pavlik, Public domain, via Wikimedia Commons. Illustrative photo; it does not show the events described.