United States President Donald Trump announced that the federal government is investigating whether North Korean state-backed hackers orchestrated a historic cyberattack on cryptocurrency exchange Binance (CRYPTO: BNB), which resulted in the theft of approximately $6.3 billion in digital assets during a 20-minute window.
The Bottom Line
- The Scale: The $6.3 billion loss surpasses the previous record—the $1.5 billion Bybit breach in February 2025—by approximately four times, according to data cited by Infobae and TRM Labs.
- The Response: Richard Teng, co-CEO of Binance, confirmed that the platform has reserved over $6.34 billion in internal funds to cover all missing assets, maintaining that user funds remain secure.
- The Attribution: Blockchain analytics firms TRM Labs, Chainalysis, and Elliptic pointed to TraderTraitor, a cyber unit operating under North Korea’s Lazarus Group, drawing procedural parallels to prior exchange compromises.
Investigation into State-Sponsored Cyber Warfare
Speaking to reporters in the Despacho Oval on Friday, October 30, 2026, President Donald Trump confirmed that American authorities are actively examining the breach. “We are looking at it,” Trump said when asked if the operation should be attributed to North Korean threat actors, adding simply, “It was a hack.”
🚨BREAKING🚨🇺🇸 PRESIDENT TRUMP SAYS HE IS LOOKING AT THE BINANCE HACK AFTER NORTH KOREA'S LAZARUS GROUP STOLE $6.36 BILLION.
The incident unfolded on Thursday, October 29, 2026, when attackers executed a coordinated sweep across ten blockchains. According to reports from Infobae and Reuters, the perpetrators drained five Binance wallets in the XRP Ledger, alongside significant volumes of Bitcoin and Ethereum. In the Ethereum network, the attackers utilized fifty pre-signed EIP-7702 authorizations to convert a company-owned hot wallet into an unauthorized clearing mechanism.
Attribution and Institutional Analysis
Blockchain intelligence firm TRM Labs stated it had “high confidence” that the operation was directed by TraderTraitor, a cyber unit linked to North Korean intelligence.
Security researchers trace the lineage of TraderTraitor back to the Lazarus Group, an entity that gained international notoriety in 2014 following the cyberattack on Sony Pictures. According to analyses cited by La Nación, the North Korean regime relies heavily on digital asset thefts to fund its ballistic missile and nuclear programs in the face of strict international sanctions, accumulating over $6.75 billion in cumulative cryptocurrency thefts over recent years.
| Security Incident | Date | Estimated Loss (USD) | Attributed Actor |
|---|---|---|---|
| Binance Breach | October 2026 | $6.3 Billion | TraderTraitor / Lazarus Group (Under Investigation) |
| Bybit Exploit | February 2025 | $1.5 Billion | Not Disclosed in Dataset |
| Ronin Network Attack | 2022 | $620 Million | Lazarus Group |
Asset Freezing and Corporate Restitution
In response to the rapid outflow, major token issuers intervened within hours of the breach. Tether froze nearly $1.57 million, Circle restricted over $800 million, and additional assets were locked by Ripple and World Liberty Financial, according to Infobae timeline data. Binance stated that approximately $3 billion of the stolen funds had been successfully frozen.
Richard Teng emphasized that the vulnerability affected a company-owned hot wallet rather than customer storage architectures. While initial company communications pointed toward a compromised laptop, subsequent forensic reviews revealed additional breach points across infrastructure endpoints and cloud services. Binance suspended deposits and withdrawals temporarily while conducting comprehensive safety tests, projecting that user withdrawal capabilities would be restored within a 40-hour window ending ahead of Sunday.
The company plans to release a formal technical report alongside a Proof of Reserves snapshot scheduled for Monday, November 2, 2026, as federal law enforcement agencies, including the FBI and the U.S. Secret Service, assist in tracking the remaining unrecovered capital.
