Cryptocurrency exchange Binance restored global withdrawals following a $6.3 billion security breach on October 29, 2026, which ranks as the largest digital coin theft in history. The attack triggered net outflows exceeding $3.6 billion, prompting federal probes and an international attribution dispute after U.S. law enforcement linked the incident to North Korea.
The security incident unfolded rapidly on October 29, 2026, when attackers drained approximately $6.3 billion in digital assets from Binance’s hot wallets across roughly 10 blockchains in about 20 minutes. Subsequent investigations by blockchain analytics firms TRM Labs and Chainalysis linked the intrusion to TraderTraitor, a state-backed hacking group also known as the Lazarus Group. Investigators observed stolen funds commingling in real time with assets from a previous exploit at Bitget, while on-chain data indicated the attackers funded their operator wallet through Tornado Cash and rehearsed the operation in advance.
Binance disclosed that the attack originated from a compromised engineer’s laptop that enabled unauthorized access to privileged systems. In response to the crisis, the exchange halted withdrawals and deposits while its security teams worked with law enforcement. By employing its corporate treasury, insurance reserves, and the Secure Asset Fund for Users (SAFU), Binance replaced approximately $6 billion—or 95% of the stolen assets—using company funds to purchase replacement tokens for affected users. The remaining 5% consisted of less liquid tokens requiring additional time to source.
Global Withdrawals and Market Impact
Global withdrawals resumed in a phased rollout prioritizing user demand, beginning with major assets such as Bitcoin, Ethereum, and select stablecoins. The phased reopening triggered a surge in customer redemptions, with DefiLlama data recording $3.64 billion in global net outflows on Sunday. The exchange noted that withdrawal volumes subsequently began declining toward normal levels, representing a small proportion of the approximately $162.8 billion in assets held in custody at the end of 2025.
Across traditional financial markets, institutional investment products also registered immediate turbulence, with U.S. spot Bitcoin exchange-traded funds recording $643 million in outflows on the day following the theft.
Asset Freezes and Laundering Investigations
As stolen funds moved across multiple blockchains, stablecoin issuers and blockchain partners intervened to block transfers. Tether CEO Paolo Ardoino announced that the company froze more than 1.567 billion USDT, while Circle froze roughly $823 million in USDC. Collaborative efforts between exchange operators and blockchain analytics firms successfully froze approximately $3 billion on-chain, predominantly in stablecoins that issuers possess the technical capacity to lock.
Photo: Yahoo Finance
However, analysts from Elliptic and Chainalysis reported that the remaining $3.3 billion—consisting largely of Bitcoin, Ether, and XRP—could not be directly frozen at the issuer level and was subjected to complex laundering operations. Hackers dispersed funds across approximately 12,000 wallets spanning 11 blockchains, executing over 40,000 transactions within the first four days through decentralized exchanges, intermediary wallets on Tron, and initial bitcoin mixing services.
Federal Investigations and Diplomatic Denials
The Federal Bureau of Investigation, the U.S. Secret Service, and the Commodity Futures Trading Commission opened formal probes into the incident. CFTC Chairman Michael Selig stated that the breach validated regulatory proposals concerning market safeguards. Meanwhile, law enforcement agencies urged industry partners to block cryptocurrency addresses associated with TraderTraitor.
Photo: BBC
The attribution of the hack drew an immediate diplomatic denial from Pyongyang. Kim Yo Jong, director of North Korea’s General Affairs Department and sister of leader Kim Jong Un, issued a statement via the Korean Central News Agency condemning the allegations as absurd rhetoric and a sinister attempt by Washington to damage the nation’s public image.
The US has made a trite provocation of linking it with the Democratic People’s Republic of Korea again,
Binance Says $6.3 Billion Impacted In Record Crypto Hack—Suspends Withdrawals
Kim Yo Jong, director of North Korea’s General Affairs Department
Kim further characterized the accusations as a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds, adding that it is the consistent policy stand of the DPRK government to resolutely oppose all sorts of malicious acts in cyberspace.
Senior Editor, Economy
An award-winning financial journalist and analyst, Daniel brings sharp insight to economic trends, markets, and policy shifts. He is recognized for breaking complex topics into clear, actionable reports for readers and investors alike.
