Binance $6.3B Hack: FBI Blames North Korea as Exchange Resumes Withdrawals

Cryptocurrency exchange Binance recently suffered a severe cyber attack on October 29, 2026, resulting in estimated damages of approximately $6.3 billion^1,2. The U.S. Federal Bureau of Investigation (FBI) officially confirmed that hackers sponsored by the North Korean government are behind the incident^2,4. This is considered the largest digital asset theft ever recorded in the history of the blockchain technology industry^1,3.

Photo: Binance t-shirt and bag - 2022-07-09 – Bretwa, CC BY-SA 4.0, via Wikimedia Commons.

Binance Hack Developments and Infiltration Method

Immediately after the incident occurred on October 29, 2026, Binance suspended all deposits and withdrawals to isolate the issue and coordinate with blockchain intelligence units to trace the assets^1,2. According to information published by BleepingComputer, the attacking group withdrew assets valued at approximately $6.36 billion spread across ten different blockchain networks, with the majority of the funds transferred in a mere 20 minutes⁴. The incident only affected the global centralized platform Binance.com, while its U.S.-based branch (Binance.US) confirmed it was unaffected³.

Photo: BalticServers data center – BalticServers.com, CC BY-SA 3.0, via Wikimedia Commons.

Regarding technical causes, an initial report from Binance stated that the attack originated from a compromised DevOps engineer's laptop, allowing the attacker to access service servers and execute unauthorized withdrawal commands^3,4,5. However, as noted by CNBC, Co-CEO Richard Teng later pointed out that the attack process was actually much more complex than simply abusing the privileges of a single engineer⁵.

Blockchain data analytics firm TRM Labs stated that this attack method matches many previous campaigns by North Korean hackers, such as withdrawing small amounts from the Tornado Cash mixer to fund operational wallets, preparing infrastructure early, and collecting approval signatures before triggering mass transactions⁵.

FBI Assigns Blame to North Korean Hacker Group

On October 31, 2026, the FBI issued a security alert stating that the North Korean state-sponsored hacking group named "TraderTraitor"—also known by the identifiers Lazarus Group, APT38, or Jade Sleet—was the perpetrator of the theft^2,4. Previously, two on-chain analytics firms, TRM Labs and Chainalysis, had also reached similar conclusions^4,5.

Photo: Cybercrime Abstract Concept – ITSveronica, CC BY-SA 4.0, via Wikimedia Commons.

According to U.S. investigators, the TraderTraitor group converted most of the stolen assets into Ethereum (ETH) and began dispersing the funds through decentralized finance (DeFi) protocols and instant swap services for money laundering purposes^2,4,5. Cooperating with the U.S. Secret Service (USSS) and the IRS Criminal Investigation (IRS-CI) division, the FBI published a list of 628 wallet addresses related to the attack, including 608 Ethereum wallets, 19 Bitcoin wallets, and 1 Solana wallet, while urging exchanges to freeze these accounts⁴.

Cybersecurity records show that this hacker group has previously executed a series of major heists, including the appropriation of $1.5 billion from Bybit in 2025, $387.5 million from Bitget in September 2026, $280 million from Drift in April 2026, and $308 million from DMM Bitcoin in May 2024⁴. Their common modus operandi is the "Operation DreamJob" recruitment phishing campaign, approaching developers on professional social networks to plant malware on personal devices⁴.

Compensation Plan and $3.64 Billion Net Outflow Wave

Following the security review phase, Binance began reopening withdrawal services on November 1, 2026, for major networks such as Bitcoin, Ethereum, and BNB Smart Chain^3,4,5. A Binance representative shared on social media platform X that between 06:00 and 15:30 GMT on November 1, the exchange processed $4.649 billion in withdrawals and received $1.01 billion in deposits, resulting in a net outflow of about $3.64 billion³. The entity affirmed that the initial surge in withdrawal pressure gradually cooled down and stabilized as expected³.

Photo: Binance and Zhao Chemgpeng guilty pleas press conference – United States Department of Justice, Public domain, via Wikimedia Commons.

To ensure customer financial security, Binance committed to bearing all arising losses itself^4,5. The enterprise extracted resources from the Secure Asset Fund for Users (SAFU), derivatives reserve funds, and corporate treasury to cover the deficit^3,5.

Regarding the refund progress, CNBC noted on October 31 that Binance had recovered 90% of the affected assets⁵, while later updates on BBC and BleepingComputer confirmed that this figure had increased to about 95%^3,4. Exchange representatives affirmed that the entire balance of the top ten cryptocurrencies—including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC—has been 100% backed^4,5. The remaining 5% belongs to lower-liquidity tokens, and the company is continuing to purchase supplements through the open market and over-the-counter (OTC) trades⁴.

Vizy's take

According to Vizy, the shocking incident at Binance once again demonstrates that the fatal weakness of digital financial institutions still lies in the human link. Even if an exchange possesses infrastructure scaled at hundreds of billions of dollars alongside multi-layered defense systems, the compromise of just a single operational engineer's personal device is enough to create a vulnerability allowing adversaries to bypass internal control mechanisms. Social engineering targeting tech personnel clearly remains the attack method with the highest success rate for sophisticated cybercrime groups.

Vizy believes that the scale of compensation exceeding $6 billion that Binance is handling showcases its immense liquidity capacity, yet it also poses an existing risk dilemma for technology enterprises and investors in Vietnam. When participating in the digital asset ecosystem, domestic blockchain solution developers must radically restructure privileged access management processes and implement an absolute Zero Trust security model across all work devices. At the same time, individual asset management units or investment funds may need to consider diversifying custodial methods, reducing the proportion of reliance on hot wallets of centralized exchanges to limit damage when systemic risks occur.

Sources

1. Nikkei Asia – Binance suspends withdrawals and freezes funds after $6.3bn hack (2026-10-31)
2. The Verge – North Korea linked to massive Binance crypto heist (2026-11-01)
3. BBC News – Binance users withdraw $3.6bn after record crypto hack (Mon, 02 No)
4. BleepingComputer – FBI links $6.3 billion Binance crypto heist to North Korean hackers (Sun, 01 No)
5. CNBC – Binance resumes withdrawals following $6.3 billion hack, says 90% of stolen user assets are covered (2026-10-31)

Compiled and analysed by Vizy from the sources above and reviewed by a Bống Media editor before publication. "Vizy's take" is the author's own opinion. For information only, not investment advice.