What to know about the $6.3 bil. hack on Binance, likely the biggest-ever crypto theft

Hackers stole more than $6 billion from Binance, the world’s largest cryptocurrency exchange, on Thursday, in what analysts said could be the biggest cryptocurrency theft on record. Binance said it had set aside more than $6.34 billion to cover losses, worked with partners to freeze about $3 billion in assets and would cover users’ losses. Blockchain firms attributed the attack to North Korea-linked hackers, while Binance and U.S. officials said investigations were underway.

TRM said about $6.36 billion was moved from Binance wallets across 10 blockchains, mostly within about 20 minutes.

Binance said its initial investigation pointed to a possibly compromised laptop, while a later investigation found additional points of breach.

Co-CEO Richard Teng said Binance’s hot wallet was affected, while the vast majority of user assets are held in offline cold wallets.

Binance said deposits were unaffected, but withdrawals were suspended and expected to resume in the next day or two.

Changpeng Zhao said the theft might be the largest by dollar value, while earlier attacks such as the Mt. Gox hack affected more bitcoin.

Published Oct 31, 2026 11:34 am KST

The Binance logo is seen on a smartphone, Feb. 28, 2023, in Marple Township, Pa. AP-Yonhap

Binance, the world's biggest cryptocurrency exchange, said Friday that hackers stole more than $6 billion in what appears to be the largest cryptocurrency heist on record. Blockchain firms have pointed to the attack coming from a North Korean hacking unit.

The company said it has reserved more than $6.34 billion of company funds to cover the stolen assets and was beginning to recover assets for users. Binance worked with blockchain partners to freeze roughly $3 billion in affected assets.

The cryptocurrency exchange has promised to cover all losses, and it has been sharing regular updates on its social media channels as it uncovers more information about the hack.

“We are working nonstop to resolve this,” Binance's co-CEO Richard Teng said Friday in a video posted to X.

In an exchange Friday with reporters at the White House, President Donald Trump said U.S. officials were investigating the Binance hack. Asked whether North Korea was involved, Trump said: “We’re looking at that.”

Here's what we know about the hack, possible North Korean involvement and Binance's investigation.

North Korean hackers are suspected in the attack

Binance said on X that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional “points of breach.”

U.S.-based blockchain intelligence firm TRM, in a post on its website late Thursday, attributed the attack to TraderTraitor, which it described as North Korea’s elite hacking unit. “We make this judgment with high confidence,” the firm said.

“An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes,” TRM said. “Several features of this attack match earlier North Korea-linked heists."

Blockchain analysis company Chainalysis also believed the Binance hack was likely carried out by TraderTraitor, its co-founder and CEO Jonathan Levin wrote on X.

Asked about the potential ties to North Korea, a Binance spokesperson said only that the company is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.”

Experts have said that North Korea turned to crypto hacking and other illicit cyber activities in recent years as a source of badly needed foreign currency to support its troubled economy and fund its nuclear program in the wake of tough U.N. sanctions and other difficulties.

In December 2022, South Korea’s spy agency said North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in cryptocurrency and other virtual assets over the past five years, more than half of it in 2022 alone. It said North Korea’s capacity to steal digital assets was considered among the world's best.

Many are calling this the biggest crypto theft on record

While about half of the stolen assets were frozen, there is evidence that the hackers already are transferring and converting some of what wasn’t recovered, said Garrick Hileman, an independent cryptocurrency analyst.

“Like in money laundering, you bring in the stolen goods and launder those through a mixer or tumbler,” he said. “You mix it in with other cryptos, and it’s harder to track.”

How long it will take the hackers to turn that into something usable isn’t clear, he said. “The bottom line is there are places in the world where you can take your bitcoin and get that converted,” Hileman said.

TRM and several other crypto firms and experts have said the hack represents the largest cryptocurrency theft on record.

In February of last year, another cryptocurrency exchange, Bybit, suffered a $1.5 billion hit when it was hacked. The FBI said North Korea and TraderTraitor were responsible for the hack. TRM listed the Bybit hack when it referenced similarities between the Binance hack and previous attacks linked to TraderTraitor.

Binance's founder, Changpeng Zhao, wrote on X that while Binance's hack might be the largest in terms of its dollar value, previous attacks on other companies like the crypto exchange Mt. Gox have had a more substantial impact in terms of the bitcoin amount affected, he said.

Experts warn this scale of hacking could become more commonplace.

“A cyber attack of this level is a matter of when, not if, particularly alongside the rise of AI,” said Andy Ward, a senior vice president at Absolute Security. “Cyber threats are becoming more sophisticated and widespread as ever, and it is likely only a matter of time before an even larger hack, with even greater financial fallout, makes headlines.”

Where experts — and Binance — say things went wrong

The hack has raised questions about why stronger approval controls were not in place, said Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab.

“This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,” he said, referring to cryptocurrency wallets that hold users' “private keys,” or unique authorizations, digitally and that are connected to the internet.

Teng, Binance’s co-CEO, confirmed in a nearly five-minute video posted on X Friday that Binance's own hot wallet was affected. “User assets are held under Binance's established security architecture," he said. "The vast majority sits in cold wallets” — which are offline and used for secure storage — “and are only moved into a hot wallet when a user makes withdrawal.”

Teng said Binance's tech and security teams are “still deep” in investigating the hack. He said it was not carried out by one person and that the attackers used complex tactics, including a "self-destruct mechanism" that is making the incident more difficult to investigate.

“We are working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen funds," Teng said. "We will do everything within our power to make sure that these bad actors will be held accountable.”

Binance has said deposits were unaffected, while withdrawals have been suspended and are expected to resume in the next day or two.

周四，全球最大的加密货币交易所币安（Binance）遭黑客攻击，损失超过60亿美元。分析人士称，这可能是史上最大的加密货币盗窃案。币安表示，已拨出超过63.4亿美元用于弥补损失，并与合作伙伴冻结了约30亿美元的资产，同时还将赔偿用户的损失。区块链公司将此次攻击归咎于与朝鲜有关联的黑客，而币安和美国官员则表示，调查正在进行中。

TRM表示，约有63.6亿美元从币安钱包转移到10个区块链上，大部分转移在20分钟内完成。

币安表示，初步调查显示可能是笔记本电脑遭到入侵，而后来的调查又发现了其他安全漏洞。

联席首席执行官 Richard Teng 表示，币安的热钱包受到了影响，而绝大多数用户资产都存放在离线冷钱包中。

币安表示，充值不受影响，但提现暂停，预计将在一两天内恢复。

赵长鹏表示，此次盗窃案的涉案金额可能是最大的，而此前的攻击，例如 Mt. Gox 黑客事件，影响的比特币数量更多。

发布于2026年10月31日上午11:34（韩国标准时间）

2023年2月28日，在宾夕法尼亚州马普尔镇，一部智能手机上显示着币安的标志。（美联社/韩联社）

全球最大的加密货币交易所币安周五表示，黑客窃取了超过60亿美元的资金，这似乎是迄今为止规模最大的加密货币盗窃案。区块链公司指出，此次攻击来自朝鲜黑客组织。

该公司表示，已拨出超过63.4亿美元的公司资金用于弥补被盗资产，并已开始为用户追回资产。币安与区块链合作伙伴合作，冻结了约30亿美元的受影响资产。

该加密货币交易所承诺赔偿所有损失，并一直在其社交媒体渠道上定期发布最新消息，分享有关此次黑客攻击的更多信息。

“我们正在不间断地努力解决这个问题，”币安联席首席执行官 Richard Teng 周五在 X 上发布的一段视频中表示。

周五在白宫与记者交流时，美国总统唐纳德·特朗普表示，美国官员正在调查币安黑客事件。当被问及朝鲜是否参与其中时，特朗普说：“我们正在调查。”

以下是我们目前了解到的有关此次黑客攻击、朝鲜可能参与其中以及币安调查的情况。

朝鲜黑客被怀疑发动了此次攻击

币安在 X 上表示，初步调查显示该事件可能与一台被入侵的笔记本电脑有关，但随后的调查发现了其他“漏洞点”。

总部位于美国的区块链情报公司TRM周四晚在其网站上发表文章，将此次攻击归咎于TraderTraitor，并称其为朝鲜的精英黑客组织。“我们对此判断充满信心，”该公司表示。

TRM表示：“攻击者从十个区块链上的币安钱包中转移了约63.6亿美元，其中大部分是在20分钟左右完成的。此次攻击的几个特征与之前朝鲜参与的盗窃案相符。”

区块链分析公司 Chainalysis 的联合创始人兼首席执行官 Jonathan Levin 在 X 上写道，该公司也认为币安黑客攻击很可能是由 TraderTraitor 实施的。

当被问及与朝鲜的潜在联系时，币安发言人仅表示，该公司“正在与执法伙伴密切合作，以确认犯罪分子的身份并将其绳之以法”。

专家表示，近年来，由于联合国严厉制裁和其他困难，朝鲜转向加密货币黑客攻击和其他非法网络活动，以获取急需的外汇来支持其陷入困境的经济并为其核计划提供资金。

2022年12月，韩国情报机构称，朝鲜黑客在过去五年中窃取了价值约1.5万亿韩元（约合11亿美元）的加密货币和其他虚拟资产，其中超过一半是在2022年被窃取的。该机构还表示，朝鲜窃取数字资产的能力位居世界前列。

许多人称这是有史以来最大的加密货币盗窃案。

独立加密货币分析师加里克·希勒曼表示，虽然大约一半被盗资产已被冻结，但有证据表明，黑客已经在转移和转换一些尚未追回的资产。

他说：“就像洗钱一样，你把赃物带进来，然后用混合器或滚筒清洗。你把它和其他加密货币混在一起，这样就更难追踪了。”

他说，黑客需要多久才能把比特币转化成可用的东西，目前还不清楚。“关键是，世界上有一些地方可以让你把比特币兑换成其他货币，”希勒曼说。

TRM 和其他几家加密货币公司及专家表示，此次黑客攻击是史上最大的加密货币盗窃案。

去年2月，另一家加密货币交易所Bybit遭遇黑客攻击，损失高达15亿美元。美国联邦调查局（FBI）称，朝鲜和TraderTraitor是此次黑客攻击的幕后黑手。TRM在提及币安（Binance）黑客攻击与此前TraderTraitor相关攻击的相似之处时，也提到了Bybit的黑客攻击事件。

币安创始人赵长鹏在X上撰文称，虽然币安此次遭黑客攻击的美元价值可能是最大的，但此前对其他公司（如加密货币交易所Mt. Gox）的攻击，就受影响的比特币数量而言，影响更为重大。

专家警告称，这种规模的黑客攻击可能会变得更加普遍。

“这种规模的网络攻击只是时间问题，而不是会不会发生的问题，尤其是在人工智能兴起的背景下，”Absolute Security高级副总裁安迪·沃德表示。“网络威胁正变得比以往任何时候都更加复杂和普遍，更大规模、造成更大经济损失的黑客攻击很可能只是时间问题，届时必将登上新闻头条。”

专家和币安都认为，事情出错的地方就在这里。

网络安全公司 NyxLab 的联合创始人兼首席执行官郭天干表示，此次黑客攻击引发了人们的质疑，为什么没有实施更严格的审批控制。

“这看起来像是一个签名，它给了攻击者一个永不过期的、对币安热钱包的完全访问权限令牌，”他说道，这里指的是加密货币钱包，它以数字方式保存用户的“私钥”（即唯一授权），并且连接到互联网。

币安联席CEO滕在周五发布于X平台的一段近五分钟的视频中证实，币安自身的热钱包也受到了影响。他表示：“用户资产受币安既定的安全架构保护。绝大多数资产都存放在冷钱包中”（冷钱包离线运行，用于安全存储），“只有在用户提现时才会转移到热钱包。”

滕表示，币安的技术和安全团队仍在深入调查此次黑客攻击事件。他指出，此次攻击并非一人所为，攻击者使用了复杂的策略，包括一种“自毁机制”，这使得调查工作更加困难。

滕先生表示：“我们正与执法部门、区块链情报公司、代币发行方和其他交易所合作，追踪并追回被盗资金。我们将竭尽全力确保这些不法分子受到法律制裁。”

币安表示，充值不受影响，但提现已暂停，预计将在未来一两天内恢复。