Hackers steal $6.3 billion from Binance in an unprecedented cyberattack. US investigators link North Korea to the operation, while the company pledges to cover the losses and begins restoring withdrawals.

Riyadh | BETH

November 1, 2026

Binance, the world's largest cryptocurrency exchange, suffered a major cyberattack in which hackers stole approximately $6.3 billion in digital assets, making it the largest cryptocurrency theft ever recorded and potentially the biggest single heist in history by financial value.

The attack occurred on the evening of Thursday, October 29, when hackers compromised systems connected to digital wallets used to process withdrawals and transfers. Most of the assets were stolen within approximately 20 minutes, although additional transfers continued for several hours.

How Did the Hack Happen?

Preliminary investigations indicated that attackers had compromised the laptop of a Binance technical operations engineer, before the company identified additional points of intrusion.

According to security analyses, the attackers gained access to transaction-signing systems responsible for authorizing digital asset transfers. This enabled them to execute unauthorized withdrawals without directly stealing the wallets' private keys.

The attack extended across wallets operating on 11 blockchain networks, including Bitcoin, Ethereum, Solana, and Tron, in a coordinated operation targeting multiple digital assets.

North Korea Officially Implicated

On October 31, the US Federal Bureau of Investigation (FBI) announced that the TraderTraitor hacking group, linked to North Korea, was responsible for the attack.

The FBI stated that the group had begun converting stolen assets into Ether and using decentralized financial services to conceal the origins of the funds and complicate efforts to trace them.

Investigative findings suggest that the incident was not simply a limited technical breach, but a coordinated operation employing sophisticated methods to control transactions and move funds across blockchain networks.

Where Did the Billions Go?

Binance announced that it was cooperating with law enforcement agencies, blockchain analytics firms, and stablecoin issuers, resulting in the freezing of assets worth nearly $3 billion.

However, freezing assets does not mean they have been permanently recovered. Investigations and tracing efforts remain underway, while the attackers are attempting to convert unfrozen assets into cryptocurrencies whose transfers are harder to restrict.

What About Customers' Funds?

Binance confirmed that it would absorb the losses in full, using its Secure Asset Fund for Users (SAFU) and its own financial resources.

The company allocated more than $6.34 billion to cover the affected assets and announced on Sunday that approximately 95% of the required asset coverage had been restored, with efforts continuing to secure the remaining cryptocurrencies.

Binance also began gradually restoring withdrawal services after suspending them for security reasons, while deposit services remained available.

There is an important distinction between replacing stolen assets and recovering them from the attackers. The former represents a financial obligation undertaken by the company, while the latter depends on successful investigations, asset freezes, and law enforcement action.

BETH Analysis | Who Protects Digital Money?

The attack exposes a challenge that extends far beyond the value of the stolen assets: the ability of digital financial institutions to secure the technological infrastructure controlling billions of dollars.

If a platform the size of Binance, with its extensive security systems and financial resources, can suffer a breach of this magnitude, serious questions arise about the security of other institutions managing digital assets for individuals and businesses.

The incident also highlights the importance of distinguishing between the security of blockchain technology itself and the security of the institutions, devices, and operational systems that use it. Vulnerabilities in supporting infrastructure can be exploited without compromising the underlying blockchain network.

The allegations linking North Korea to the attack add an international security dimension, as digital asset theft has increasingly become associated with organized crime and cross-border cyber operations.

The central question is no longer simply how hackers stole $6.3 billion, but how they managed to bypass financial authorization systems—and whether digital asset platforms can prevent another attack of this scale.

Prepared and analyzed by | Strategic Media Department – BETH News Agency