Binance hit by reported $6.3B multi-chain theft; TraderTraitor link flagged
Binance reported a security incident on October 29, 2026, in which reports say about $6.3 billion was moved out of its wallets across 10 blockchains. Roughly $3 billion has reportedly been frozen on-chain with help from partners, and blockchain intelligence firm TRM Labs has linked the theft to North Korea's TraderTraitor group. The loss figures and some details still conflict across reports, and Binance has not confirmed the attribution.
What happened
According to multiple reports, an attacker moved assets out of Binance-controlled wallets on October 29, 2026. Reported totals range from about $5.9B to $6.36B, with $6.3B the most common figure. Binance has described the event as a security incident and a complex attack.
Binance's initial findings, as reported by several outlets, point to a compromised DevOps engineer's laptop that was used to submit unauthorized withdrawals. Reports say Binance has not found evidence of leaked wallet private keys. Binance has not published a full post-mortem, so this account has not been independently verified.
Timeline
The outflow reportedly began around 20:05 UTC on October 29, 2026, and most of the movement happened within about 20 minutes. One report describes a second wave of unauthorized transfers about three hours later.
Binance then suspended withdrawals and deposits while it worked with blockchain partners to freeze assets. On October 30, Binance reportedly said withdrawals could resume within about 48 hours, after a security review and technical post-mortem.
Where the money went and what is frozen
CoinDesk reported that the attacker moved about 18,270 BTC, worth roughly $1.4B at early Friday prices, and split it across 19 wallets. Reports say 17 of those wallets hold exactly 1,000 BTC each, and the others hold 832.5 BTC and 437.7 BTC. As of early Friday, those coins had reportedly not moved again.
Frozen amounts are reported as about $3B, although one headline cites about $2.5B, and it is unclear how much of the total is specific to Binance. Reports also say some freezes were made by stablecoin issuers and that Aave froze Avalanche markets while Arbitrum locked about $30.5M. Those actions are described as separate from Binance and their link to this incident is not fully clear. Reports say about $2.4B was still not frozen, mainly in BTC and ETH, but these numbers vary between outlets.
Attribution: TraderTraitor
TRM Labs has attributed the theft to TraderTraitor, a North Korea-linked hacking group, and reportedly said it had high confidence in that assessment. Chainalysis and ZachXBT have also been reported as linking the activity to the same actor.
These are intelligence assessments. Binance has not publicly confirmed the attribution, and no law enforcement agency has been reported as formally adopting it. Reports also connect TraderTraitor to the February 2025 Bybit theft.
Market impact
Bitcoin reportedly slid below $77,000 on October 30 as the news rattled markets, and an Indian exchange was reported to have curbed futures trading. Reports say the incident intensified concern about exchange custody and hot-wallet security.
Market effects are reported, not measured in a way this article can confirm. The freezes may have limited the immediate loss, but the final total could still change as tracing continues.
What it means for users and what to do now
Reports say Binance states that user funds are safe and that it will cover losses. Those are Binance's claims and have not been independently verified. Reports also say the incident affected Binance-controlled wallets rather than a confirmed list of customer accounts.
Until Binance issues specific instructions, avoid rushing to move funds. Check Binance's official status notices for deposit and withdrawal updates, enable 2FA and change passwords if needed, and be wary of messages offering refunds, verification, or recovery. If you use API keys or exchange-connected tools, review and revoke any you do not need. Long-term holdings are often kept in self-custody, but that decision is a personal one and this is not investment advice.
What we still don't know
The exact total loss is unresolved: reports cite $5.9B, $6.3B, and $6.36B. A full breakdown by asset and chain has not been published.
It is unclear how much has been frozen or recovered, and the roughly $3B figure may include freezes across the wider ecosystem.
Binance has not published a full root-cause analysis. It is not confirmed how the laptop was compromised or whether other systems or insiders were involved.
No full list of attacker wallet addresses has been published. It is also unclear whether Binance will formally confirm the TraderTraitor attribution, whether regulators or law enforcement will act, and when withdrawals will resume.
See it in live data
Follow VaultX's updates for verified developments as Binance publishes its post-mortem and withdrawal status.
Open the live viewGet alerts on TelegramQuestions people ask
Are my Binance funds safe?
Binance has reportedly said user funds are safe and that it will cover losses. Those statements come from Binance and have not been independently verified. Check official Binance notices for account-specific information.
Has Binance confirmed North Korea was behind the attack?
No. TRM Labs and other blockchain analysts have attributed the theft to TraderTraitor, a North Korea-linked group, but Binance has not publicly confirmed that attribution in the material reviewed.
Should I move my crypto off Binance now?
Reports do not give a single answer for every user. Avoid acting in a panic, follow Binance's official updates on withdrawals, and beware of phishing. Any decision about moving funds is personal, and this is not investment advice.
Get instant hack alerts
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
Related on VaultX
Sources
- CoinDesk: Binance hacker splits $1.4B of Bitcoin into 19 wallets
- UPI: Binance North Korea theft
- CNBC: Billions in crypto frozen in Binance hack, here's what happens next
- Cointelegraph: North Korea linked to $6.3B Binance hack by crypto investigators
- TRM Labs: North Korea steals $6.36 billion from Binance
- BleepingComputer: Binance links $6.3B theft to compromised DevOps laptop
- The National: Bitcoin slides below $77,000 as Binance hack rattles markets
Written by an AI agent from public data and reviewed by automated checks. Breaking story: figures can change as it develops. Educational only, not investment advice.
VaultX