| Follow up to this story from yesterday. |
The company noted that part of the funds—$3 billion—was frozen.
According to preliminary information, the leak was caused by a security vulnerability. An attacker gained access to the work laptop of one of the company's engineers, which allowed them to penetrate the service's container and withdraw funds.
Analysts speculate that the North Korean hacker group TraderTraitor may have been behind the attack. This assumption is based on similarities in methods to previous thefts. Specifically, in February 2025, the same group stole $1.5 billion from the cryptocurrency exchange Bybit.
Binance management promised to cover all losses from the large-scale hack using its own funds and the user protection reserve fund (SAFU).
Previously, Binance stated that there was no threat to user funds amid reports of a possible platform hack. Experts are conducting an investigation and urgently reviewing information about the potential security issue. The company intends to publish verified information through official channels.
On October 30, former Binance CEO Changpeng Zhao stated that the crypto exchange may have been hacked. He clarified that he no longer manages Binance.com, but as a shareholder, he expects a full refund of all user funds.
Binance is one of the world's largest centralized crypto exchanges, acting as an intermediary between buyers and sellers of digital assets. According to public data, it was used by approximately 300 million people in 2026, with annual trading volume in the tens of trillions of dollars.
| Courtesy of Skidmark: |
[NYPost] A notorious North Korean hacking unit may have compromised a single Binance employee’s laptop to pull off the record-breaking $6.3 billion hack of the cryptocurrency exchange – indicating a potential inside job or a stunning AI-powered infiltration of the company’s software.
Binance, the world’s largest crypto exchange, initially said the digital theft of the century may have centered on an engineer’s laptop, later adding that it identified “additional points of breach” – suggesting a complex attack carried out by more than one person.
Ido Ben-Natan, CEO of Blockaid, which was the first party to identify Thursday’s attack, within just two minutes of the drain, said he wouldn’t rule out an inside job.
“In order to penetrate the network, phishing is one option or getting someone hired at Binance,” Ben-Natan told The Post.
However, he said North Korean hackers most likely leveraged artificial intelligence. AI models are increasingly able to detect crypto exchanges’ unknown software flaws – known as “zero-day vulnerabilities” — enabling hackers to carry out much larger heists.
Crypto hacks have been growing larger and more frequent, with roughly $1.2 billion stolen in 255 attacks from July to September – up from $822 million in 222 incidents from April to June, according to data from blockchain security firm CertiK.
TraderTraitor, the North Korean cybercrime group suspected of the record-breaking Binance attack, was also tied to a $1.5 billion heist targeting crypto exchange Bybit last year, then the largest attack in history.
Crypto exchanges are easy targets for hacking groups like TraderTraitor, since digital assets can be transferred around the world much faster than any physical asset, and with a degree of anonymity – making them much more difficult to recover.
“They tried more than 50 times” to get into the exchange, Ben-Natan said.
Once inside, the hackers started draining crypto accounts, a process that took just 20 minutes, then scrambled to send the riches to different networks around the world, he said.
“This attack was done by North Korea, that’s clear,” Ben-Natan said. “Any time there is a hacking like this, money starts being sent everywhere as quickly as possible.”
Richard Teng, co-CEO of Binance, said Friday that the hackers “also used a self-destruct mechanism … making it more difficult for us to trace and investigate.”
Hackers typically rely on social engineering, software hacks or some sort of combination.
In the first instance, attackers trick humans – like employees at the company – into giving them access to private systems by sending scam emails or messages. They might also steal employee credentials or passwords.
Idan Ofrat, co-founder of Fireblocks said it was likely that the hackers used “a phishing attempt like a LinkedIn message or email. With the right security practices, all of this could have been prevented.”
Hackers might also target weaknesses in an exchange’s blockchain to disable security controls. One example is when attackers steal cryptographic keys that authorize transactions, allowing them to move funds out of crypto wallets without the necessary passwords.
After an attack, hackers rush to launder money to avoid losses from currency being frozen – one example is putting crypto into a decentralized lending market. Hackers can still take out loans based on the amount even if currencies are frozen.
The crypto exchange added that it’s on track to allow customers to make withdrawals within two days and that it has set over $6 billion of company funds aside to cover customers’ losses.
Blockchain transactions are permanently recorded, which allows officials to track stolen funds as they move between wallets and exchanges. Centralized crypto exchanges and stablecoin providers have the ability to freeze assets on their platforms.
But freezing assets is not the same as recovering them. Since the industry is still largely unregulated, getting back stolen funds can be a long and tedious process, involving cooperation from crypto exchanges, token issuers and law enforcement.
Absent such cooperation, the digital moolah is gone for good.
Related:
Binance 10/30/2026 World's biggest ever crypto heist results in hackers making off with at least $6.3billion, exchange boss says
Binance 08/01/2026 Illicit Iranian gambling network helped pull off a $4 billion sanctions dodge
Binance 07/07/2026 Who Funds The Fire?
Binance 10/30/2026 World's biggest ever crypto heist results in hackers making off with at least $6.3billion, exchange boss says
Binance 08/01/2026 Illicit Iranian gambling network helped pull off a $4 billion sanctions dodge
Binance 07/07/2026 Who Funds The Fire?