Blockchain intelligence firm TRM Labs has attributed the security breach at the cryptocurrency exchange Binance to TraderTraitor, an elite hacking unit linked to North Korea. The firm describes the attack as the largest crypto theft on record and says it makes this judgment with high confidence, based on what it calls robust on-chain and off-chain intelligence.
According to TRM, an attacker moved approximately $6.36bn out of Binance wallets across ten blockchains on 29 October 2026. Most of the funds left in about 20 minutes, beginning at 20:05 UTC. The scale makes the incident roughly four times the size of the $1.5bn Bybit hack of February 2025, which had previously stood among the largest thefts in the sector.
Binance has confirmed a security incident and suspended withdrawals on several networks while the matter is investigated. The company said an initial review suggests the breach may involve a compromised laptop belonging to a DevOps engineer, which could have allowed an attacker to submit unauthorised withdrawal transactions. Binance has not, in the material available, set out how the compromise spread to its wallet infrastructure.
TRM said it is tracking the stolen funds and alerting partners through its Beacon Network, a platform it uses to share information about illicit transactions across the industry. The firm's attribution to North Korea places the theft within a pattern of state-linked cyber activity against digital asset platforms that security researchers have documented in recent years.
The reported loss has also rippled through the wider crypto market. Coverage of the incident recorded sharp falls in Bitcoin and Ethereum after the theft became public, with some outlets reporting the sum stolen at around £4.7bn. Market moves of that kind are typical when a single exchange loses such a large volume of assets, as confidence in custody arrangements is tested across the sector.
The Bybit comparison is the most useful reference point for the scale of the Binance loss. The earlier theft, at $1.5bn, was itself widely treated as a landmark case, and the gap between the two incidents underlines how quickly losses at the largest exchanges have grown. Whether the Binance attribution is confirmed by other investigators, and how much of the stolen money can be traced or recovered, remains open in the material available.