Binance reports record theft of $6.3 billion
The crypto exchange says losses will be reimbursed, while investigators point to a possible North Korean hacking group.
Follow-up to: Binance investigates possible security incident Friday, 30 October 2026, 02:55
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Hackers have taken approximately $6.3 billion in cryptocurrency from Binance wallets, according to Reuters. The exchange says users will be fully compensated from a security fund and its own resources, but the technical and criminal investigations have not yet been completed.
The incident follows the security problem Binance reported on Thursday. The exchange said at the time that an initial investigation pointed to a possibly infected laptop, after which, according to the exchange, multiple points of access were later found. Reuters writes, based on Binance and an analysis of blockchain data, that approximately $6.3 billion was moved from wallets used by the exchange to process transactions.
The largest movement took place over approximately twenty minutes, shortly after 8pm Dutch time on Thursday, according to blockchain data. Binance has not said that a wallet’s private key was leaked. According to the exchange, an attacker may have gained access to a service environment through a compromised laptop and submitted unauthorised withdrawal requests.
Binance says it will cover customers’ losses using the Secure Asset Fund for Users, a reserve that, according to its own website, contains approximately $1 billion in bitcoin, supplemented with company funds. The exchange says users’ assets are safe. According to the exchange, deposits were not affected; withdrawals were temporarily suspended and were expected to resume within one to two days.
Approximately $3 billion in affected assets has since been frozen, according to Binance and blockchain partners. AP mentions frozen funds held by Tether and Circle in this context. AP reported that Tether had frozen more than $1.5 billion and Circle more than $800 million in funds thought to be related.
That does not automatically mean that all the funds will return to Binance. According to blockchain researchers, approximately $2.4 billion in bitcoin and ether remains beyond the exchange’s reach.
Several American blockchain companies see similarities with earlier attacks attributed to North Korean hackers. TRM Labs says with a high degree of confidence that the attack displays characteristics of TraderTraitor, a group the company links to North Korea. Chainalysis draws a similar preliminary conclusion. Binance itself says it does not yet know who was behind the attack.
The case adds to questions about the security of crypto exchanges, even if customers are ultimately reimbursed. The incident shows that not only private keys, but also systems that authorise transactions, are targets. For users, regulators and banks, it is also important how quickly stolen funds can be traced and how much of them can actually be recovered.
The scale of the theft is still based on a combination of exchange information and blockchain analysis. AP initially reported that Binance had not explicitly confirmed that all the affected cryptocurrencies had been stolen; Reuters later reported that hackers had made off with $6.3 billion. The technical reconstruction and attribution to North Korea therefore remain subjects of investigation for the time being.
One story, several perspectives
What is established
- Binance reports an estimated impact of approximately $6.3 billion.
- The exchange says it will reimburse losses.
- Blockchain companies have provisionally linked the attack to a North Korean group.
- Some of the funds have been frozen, but not all cryptocurrencies can be blocked centrally.
Left
Arguments The scale of the attack shows that self-regulation and voluntary security reserves provide insufficient protection. Crypto exchanges should be subject to strict financial supervision, with firm requirements for security, transparency and compensation.
Values Consumer protection, public oversight and limiting financial risks.
Consequences Stricter rules could increase confidence, but could also push smaller providers out of the market and slow innovation.
Centre
Arguments The sector needs room for innovation, but incidents like this call for proportionate minimum requirements for access management, audits, reporting and reserves. Supervision should limit risks without treating every crypto exchange as a bank.
Values A balance between innovation, responsibility and financial stability.
Consequences Harmonised European rules could provide clarity, but would remain dependent on international cooperation and technical expertise.
Right
Arguments Customers should be able to choose how much risk they take, and providers should primarily be held liable for their own security failures. A major government response could actually encourage risky behaviour if companies expect users always to be compensated.
Values Individual responsibility, market forces and restrained government intervention.
Consequences Greater freedom of choice could stimulate innovation, but users could face major losses without robust information and capital requirements.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article’s central claims have been confirmed by Reuters and AP. The attribution to North Korea and the precise scale of the stolen funds are clearly presented as preliminary investigative findings.
- confirmed Approximately $6.3 billion in cryptocurrency was moved from Binance wallets. — Reuters reports this based on Binance and blockchain analysis; AP cites an impact of approximately $6.3 billion. source
- confirmed Binance says it will reimburse losses using a security fund and its own resources. — Reuters quotes Binance chief executive Richard Teng on this. source
- confirmed Approximately $3 billion in assets has been frozen. — AP reports that Binance and blockchain partners have frozen approximately $3 billion. source
- confirmed Researchers see similarities with earlier North Korean attacks. — AP quotes TRM Labs and Chainalysis; Binance has not yet identified the perpetrators. source
- confirmed The largest movement took place over approximately twenty minutes. — Reuters and TRM Labs describe this timing based on blockchain data. source
Editor's note
Reuters reports the scale of the theft based on Binance and blockchain analysis. AP stressed that Binance had initially not explicitly confirmed that all the affected funds had been stolen. The possible North Korean involvement is an assessment by blockchain companies, not an established perpetrator.Sources
The story so far
- Friday, 30 October 2026, 02:55 Binance investigates possible security incident
- Friday, 30 October 2026, 13:24 Binance reports record theft of $6.3 billion (this article)
More on this in Dutch media
- de Volkskrant — „binance cryptovaluta”
- NOS — „binance cryptovaluta”
- Het Parool — „binance cryptovaluta”