Binance hit by 'largest crypto theft on record' as North Korean hackers steal $6.3bn in just 20 minutes

Date:
Fri, 30 Oct 2026 12:21:44 +0000

Description:
Lazarus is breaking its own records year after year but Binance says user funds are SAFU.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Attackers allegedly stole $6.36 billion from Binance in a record-breaking cryptocurrency exchange breach Investigators linked the attack to North Koreas Lazarus Group, exploiting access from a compromised engineer Binance said customer funds remain safe, while authorities and partners froze billions in stolen assets
Cybercriminals, allegedly from an infamous North Korean hacking organization, have gained access to one of the biggest cryptocurrency exchanges on the planet - Binance - and in less than half an hour withdrew $6.36 billion worth of different tokens.

Security researchers TRM Labs said the attack was carried out by a group called TraderTraitor, which it describes as North Koreas premier hacking
unit. We base this assessment on robust on and off-chain intelligence
sources, TRM Labs said in a report, noting that TraderTraitor is part of Lazarus Group, North Koreas state-sponsored threat actor blamed for some of the biggest crypto heists in history, with the FBI blaming it for the $1.5 billion Bybit hack that took place on February 21, 2025. Latest Videos From TechRadar Watch full video here: Gone in 20 minutes Binances experts, as well as independent researchers, are still piecing together what happened, so information might change throughout the day(s). What we know so far is that a DevOps engineer had their laptop compromised, which was confirmed by Richard Teng, Binance co-CEO, in a LinkedIn post.

That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions, he said. You may like Liquid Network halts new transactions after 'nice guy' hackers steal nearly all its Bitcoin but then return most of it after a patch is issued North Korean 'Contagious Interview' gang hits 30,000 businesses across the world with malware
following fake interviews US Treasury wants banks to be better at filing file cyber scam reports after noting nearly $13 billion in losses since 2023

Right now, no one really knows what exactly happened and what it means that a DevOps engineers laptop was compromised. However, we do know that Lazarus is famous for running operations DreamJob and Contagious Interview, in which
they set up fake companies and fake jobs, and then approach software
engineers working on crypto projects. They entice them with lucrative job offers and exciting opportunities, and sneak malware during the multiple interview rounds.

But Binances security measures are more robust than that, and simply installing malware on one device could not have sufficed. Teng confirmed
that, too, saying the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over. Funds are SAFU TRM
Labs said the attackers pulled funds from 10 different chains, including Bitcoin, Ethereum, XRP, Tron, Solana, Arbitrum, Optimism, Base, Avalanche,
and Polygon. The Ethereum chain was the hardest one hit, losing roughly $3.79 billion. It could be because of the chains smart contracts feature, which allowed the attackers to keep withdrawing funds as they were landing into the wallet.

Binance is one of the biggest and most popular cryptocurrency exchanges on planet Earth, and as such it holds billions of dollars in user funds. This attack, however, did not target user funds, but rather Binance itself. This was confirmed by both Teng and TRM Labs, with the co-CEO saying your funds
are safe, and Binance will cover all losses from the SAFU fund and company funds.

In response to the attack, Binance temporarily restricted deposits and withdrawals. Numerous users took to X this morning to say their transaction requests were denied. The police and other relevant entities were notified, and around $3 billion were already frozen on-chain, apparently. What to read next Security experts warn North Korean hackers aren't just using AI in their new campaigns, but also 'post-quantum' encryption Revolut sent identity data, contact details, and documents to hackers posing as a government agency Top
US hedge funds targeted by major vishing campaign

Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, TRM Labs confirmed, while Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly $2.7 billion.

Whats particularly interesting about this incident is how the market responded. In 2013, when Mt.Gox (at the time the biggest crypto exchange in the world) got hacked for $450 million, it was considered a black swan event, sending bitcoin down by more than a third (35%) in a few weeks. The 2025
Bybit hack sent BTC down approximately 7.5%. In response to the Binance hack, BTC dropped a measly 6.7%, which is just another Friday in the crypto world. Phishing incoming Trouble always comes in pairs, and this Binance hack will most likely be no exception. Security researchers NordVPN are warning users that other hacking groups might try to take advantage of the news to target users with phishing emails.

Another risk is criminals exploiting the confusion and fear among crypto owners on other platforms. An email claiming your funds are at risk, a fake support account offering help or a message urging you to move your cryptocurrency to a safe wallet could be an attempt to steal from you, said Marijus Briedis, Chief Technology Officer at NordVPN.

Check updates through the Binance app or a website address you already trust. Avoid links in unsolicited messages, and never give anyone your password, verification codes or wallet recovery phrase. Pressure to act immediately should be a reason to pause and verify the request.

These steps can reduce the risk of someone taking over your account, but they cannot prevent a breach of the platform itself. Cryptocurrency firms
typically have watertight cybersecurity, as they are digital-first
businesses, so if one can be involved in the biggest hack in history, it
shows just how lucrative a single flaw can be. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/binance-hit-by-largest-crypto-theft-on- record-as-north-korean-hackers-steal-usd6-3bn-in-just-20-minutes


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)