Hackers Steal $6.3 Billion From Binance in Just 20 Minutes in What Could Be the Biggest Heist in History

A group of hackers believed to be operating on behalf of North Korea has reportedly carried out one of the largest financial thefts ever recorded, stealing approximately $6.3 billion in cryptocurrency from Binance in an extraordinary cyberattack that security experts say may have taken just 20 minutes to execute.

The attack, which took place on Thursday, October 29, 2026, targeted the world’s largest cryptocurrency exchange and immediately raised serious concerns about the security of digital assets, particularly after investigators discovered that the criminals may have gained access to critical systems through a compromised employee laptop.

According to blockchain intelligence company TRM Labs, the operation bears the hallmarks of TraderTraitor, a sophisticated hacking organisation linked to North Korea that has previously been accused of carrying out several major cryptocurrency thefts, although the identity of those responsible has not yet been officially confirmed by law enforcement.

Investigators believe the attackers managed to compromise a laptop belonging to a Binance DevOps engineer, allowing them to access a service container connected to the company’s infrastructure and initiate unauthorised cryptocurrency withdrawals across multiple blockchain networks.

What makes the incident particularly alarming is the speed at which the stolen funds were transferred, with blockchain researchers reporting that billions of dollars moved through different digital networks within minutes, leaving investigators with an enormous challenge as they attempt to trace the money and prevent further transfers.

Binance co-chief executive Richard Teng acknowledged the security breach and explained that the company’s preliminary investigation pointed towards a compromised engineering laptop, while stressing that the attack involved a complicated sequence of actions rather than a single employee accidentally granting access to the entire system.

The company subsequently revealed that investigators had discovered additional security weaknesses connected to the incident, suggesting that the criminals may have exploited several vulnerabilities before successfully moving such an extraordinary amount of cryptocurrency.

Although the initial reports suggested that approximately $6.3 billion had disappeared, Binance and its industry partners have already managed to freeze roughly $3 billion in digital assets, potentially preventing the attackers from gaining full control of a substantial portion of the stolen funds.

However, freezing cryptocurrency does not necessarily mean the money has been returned to its rightful owners, and investigators are continuing to examine transactions across different blockchain networks to determine how much can ultimately be recovered.

Binance has assured customers that it intends to cover losses caused by the attack using company funds, while temporarily suspending certain services during its security investigation and working with law enforcement agencies and cryptocurrency companies to identify and block suspicious transactions.

The FBI has also become involved in the investigation, confirming that it is coordinating with relevant public and private organisations to assess the scale of the incident and understand how the criminals managed to bypass security measures protecting billions of dollars in digital assets.

Cybersecurity specialists have described the theft as an exceptionally sophisticated operation, particularly because the attackers apparently managed to manipulate systems responsible for authorising withdrawals rather than simply obtaining access to an ordinary customer account.

Experts believe the suspected North Korean hackers may have spent considerable time preparing the operation, gathering information about Binance’s internal systems and identifying weaknesses that could allow them to move enormous sums before security teams had an opportunity to respond.

The TraderTraitor hacking group has previously been connected to the February 2025 attack on cryptocurrency exchange Bybit, during which approximately $1.5 billion in digital assets was stolen, making that incident one of the largest cryptocurrency thefts recorded at the time.

North Korean hacking organisations have attracted increasing attention from international authorities because of allegations that stolen cryptocurrency is used to generate revenue for the country’s government, including programmes connected to weapons development and other activities restricted by international sanctions.

American officials have repeatedly warned that cybercrime has become an important source of income for North Korea, allowing the country to obtain foreign currency despite restrictions intended to limit its access to the international financial system.

The latest attack also prompted an unusual exchange on social media after billionaire Elon Musk reacted to reports of the theft with laughing emojis, drawing a response from Binance co-founder Changpeng Zhao, who criticised the timing of the reaction and reminded Musk of the company’s financial investment in his businesses.

Meanwhile, cryptocurrency markets experienced renewed selling pressure as news of the breach spread, with Bitcoin, Ethereum, Solana and Binance’s own BNB token recording declines amid concerns about the potential consequences for the wider digital asset industry.

The incident has also reignited questions about whether cryptocurrency exchanges have sufficient safeguards to protect customer funds, especially when internal systems connected to employee devices can potentially become an entry point for attackers seeking access to enormous financial reserves.

Unlike traditional bank robberies, which typically involve physically entering a building or compromising individual accounts, sophisticated cryptocurrency attacks can allow criminals to move billions of dollars across international networks without ever setting foot inside the targeted organisation.

Although blockchain transactions are generally recorded on publicly accessible ledgers, criminals can attempt to conceal the origins of stolen assets by transferring them between multiple cryptocurrencies, digital wallets and services designed to obscure transaction histories.

Security researchers are now examining whether the Binance attack could lead to stronger industry-wide requirements for transaction approvals, employee access controls and the separation of systems responsible for holding and transferring customer funds.

For Binance, the immediate priority remains recovering as much cryptocurrency as possible, reassuring customers about the safety of their remaining assets and determining precisely how attackers managed to exploit the company’s security infrastructure.

With billions of dollars still potentially beyond the company’s control and investigators working to establish who was responsible, the extraordinary theft could become a defining moment for the cryptocurrency industry and a reminder that even the largest digital financial platforms remain vulnerable to sophisticated cybercriminals.