Crypto giant Binance attempting to recover $6.3bn stolen in hack linked to North Korea

ByJaroslav Lukiv and Joe Tidy, Cyber correspondent. 30 October 2026, 16: 03 GMT.

Key points

• Binance, which was founded in China in 2017, allows users to trade digital assets and is estimated to have more than 300 million registered users worldwide.
• The firm stated in 2024 that it had more than $160bn in assets under its custody.
• AI-powered investigations firm TRM Labs stated that a number of elements of the attack resembled earlier North Korean-linked incidents, including the Bybit hack.
• In almost all cases investigators have blamed hackers from North Korea, pointing to the infamous Lazarus Group – additionally know as TraderTraitor.
• Binance's co-CEO Richard Teng remarked: This was not carried out by one person.

After $6.3bn (£4.7bn) was accessed in what is believed to be a record heist, binance, the world's largest cryptocurrency exchange, notes it has frozen around half of the funds stolen in a "complex" hack.

Notably, the firm remarked $3bn of its stolen digital assets had been secured – but numerous were still in the hands of unidentified hackers. It initially thought an engineer's laptop had been compromised, allowing unauthorised withdrawals, but afterwards stated the attack was wider.

In practice, a number of analytics firms have linked the hack. It eclipses a $1.5bn (£1.12bn) heist on the Bybit exchange in 2025, to a North Korean hacking unit.

In practice, the US Secret Service remarked it was "working around the clock" "to identify, freeze, trace, and recover" stolen funds.

While Binance additionally noted it was working with the FBI, america's lead federal agency for investigating financial crimes continued that it would "identify the cyber criminals responsible and bring them to justice".

Notably, the firm additionally informed its users "your money is safe, and we're covering every loss".

Binance had initially suspended all deposits and withdrawals – but then remarked in an update that "deposits remain unaffected".

Who could be behind the Binance hack and what we know so far.

Binance's co-CEO Richard Teng remarked: "This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, nevertheless our subsequent investigation has uncovered further points of breach."

Teng additionally describes how the hackers employed "a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate".

Initially, the firm had indicated the breach "may have started with a compromised DevOps engineer's laptop" but afterwards statements have pointed to a broader breach.

In practice, the firm stated in 2024 that it had more than $160bn in assets under its custody.

Meanwhile, a lot of the fear right now from Binance users – and the crypto industry at sizeable – is whether or not Binance will actually be capable of covering this enormous financial loss.

For context, the firm has stated repeatedly that customer funds will be covered and that the firm is solid enough to weather the storm.

But crypto history watchers have been pointing out online that this is exactly the kind of message that FTX CEO Sam Bankman-Fried offered before his crypto exchange collapsed in 2022, leading to enormous losses for customers and the industry. Binance has been subject of regulatory scrutiny worldwide.

Meanwhile, AI-powered investigations firm TRM Labs stated that a number of elements of the attack resembled earlier North Korean-linked incidents, including the Bybit hack.

In the last five years the crypto industry has been beset by enormous losses from hackers.

In almost all cases investigators have blamed hackers from North Korea, pointing to the infamous Lazarus Group – additionally know as TraderTraitor. The names refer to clusters of cyber criminals accused of working directly for the regime.

Chainalysis, a crypto analytics firm, remarked it had "high confidence" that a North Korean is linked to the hack.

North Korea is an impoverished country with particularly little industry and heavy international sanctions and experts say the regime uses cyber crime as a way to bring capital in.

North Korea has always denied this, but the wealth of evidence from cryptocurrency flow analysis and insider interviews from defectors is compelling.

It makes North Korea probable to be the only nation that uses hacking as a way to raise public funds.

In short, crypto giant Binance attempting to recover $6.3bn stolen in hack linked to is the central thread here, and readers can expect follow-up reporting as the picture becomes clearer.