The Binance North Korea hack is now the leading explanation for the largest cryptocurrency theft ever recorded, after three blockchain-tracing firms pointed the finger at Pyongyang and United States law enforcement joined the race to recover about $6 billion stolen from the world's biggest crypto exchange. The Binance North Korea hack, first reported on Thursday, October 29, 2026, has moved in a single day from a suspected exploit to a case with a named suspect in the eyes of investigators, a frozen pot of roughly $3 billion, and a promise from Binance that withdrawals could resume by Sunday morning.

Key Points

• TRM Labs, Chainalysis and Pangolin Intelligence have all linked the Binance North Korea hack to an elite North Korean hacking unit, with Chainalysis saying it has "high confidence" in the attribution.
• About $3 billion of the roughly $6 billion stolen has been frozen by crypto firms, while the rest is being tracked across multiple blockchains, including bitcoin and ethereum.
• The FBI said on Friday it is "aware of the incident and is engaged" with partners, and the US Secret Service said its investigators are working "around the clock" with Circle and federal prosecutors.
• Binance itself has not named North Korea: co-CEO Richard Tend said the investigation has not attributed responsibility to any individual and found no evidence of a wallet private key leak.
• Binance expects withdrawal services to resume by Sunday morning, and says it will cover all losses from company funds and an emergency assets fund.

What Happened

Binance, the world's largest cryptocurrency exchange, suspended deposits and withdrawals on Thursday after hackers broke into its digital wallets and stole funds now estimated at about $6.3 billion in the company's own assessment, and about $6 billion in the trackers' estimates. Binance said late on Thursday that its initial investigation suggested the hack went through a compromised DevOps engineer's laptop, "which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." The company stressed there was no evidence of any wallet private key leak, and that affected address authorisations had been revoked.

On Friday, the story moved decisively. CNN reported that multiple crypto-tracing firms now believe the hack originated in North Korea. TRM Labs attributed the heist to an elite North Korean hacking unit "based on robust on and off-chain intelligence," adding that "several features of this attack match earlier North Korea-linked heists." Pangolin Intelligence, a Singapore-based blockchain-tracking firm, said it also believed a North Korean hacking unit was behind the heist, after "analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents." Chainalysis, another major crypto-tracing company, told CNN it was monitoring stolen funds "moving across multiple blockchains," including bitcoin and ethereum, and that it had "high confidence" North Korea was behind the hack.

An analyst with Pangolin Intelligence, who did not want to be named for privacy reasons, warned that the recovery battle is only beginning. "I think the cat and mouse game has barely begun yet," the analyst told CNN, adding that North Korea was likely poised to tap a network of money laundering organisations to try to cash out the stolen funds. CNN said it had reached out to North Korea's mission at the United Nations for comment, and noted that Pyongyang has previously denied hacking allegations.

Background: How the Binance Hack Unfolded

The scale of the theft is difficult to overstate. At roughly $6 billion, it is about four times the previous record crypto heist, the roughly $1.5 billion stolen from Bybit, another major exchange, in February 2025, an attack also blamed on North Korean hackers. In that case, the attackers stole an amount equal to a significant portion of North Korea's reported annual gross domestic product in a matter of minutes, CNN noted.

Binance was co-founded in 2017 by Canadian national Changpeng Zhao, and became the world's largest crypto trading platform within a year of its launch. Zhao stepped down in 2023 after pleading guilty to violating anti-money laundering laws in the United States. He was sentenced to four months in federal prison, and was pardoned by President Donald Trump in October 2025. Zhao, who no longer manages the platform but remains its largest shareholder, said on X that he expects user funds to be fully covered by the exchange, pushing back against any suggestion to the contrary in a spat on X with Elon Musk.

Unlike platforms for trading stocks, cryptocurrency exchanges tend to hold digital assets on their users' behalf, which makes them more vulnerable to hackers and theft, particularly given a lack of regulatory oversight within the relatively nascent industry, CNN observed. That custodial model is why a single breach at Binance, which serves hundreds of millions of users, can produce losses on a scale no traditional exchange hack could match.

Read our earlier coverage of the heist itself here: Binance Hack Drains $5.7 Billion in Largest Crypto Heist Ever Reported, and of Binance's official announcement here: Binance Suspends Withdrawals for All Users, Confirms $6.3 Billion Hack Impact.

Binance North Korea Hack: What the Tracers Found

The Binance North Korea hack attribution rests on pattern-matching across blockchains, not on a single smoking gun. TRM Labs pointed to on-chain and off-chain intelligence linking the attack's features to earlier North Korea-linked heists. Chainalysis, which is tracking the stolen funds as they move across bitcoin, ethereum and other chains, expressed high confidence in the same conclusion. Pangolin Intelligence reached the same view by correlating the hack's on-chain activity with information gathered from previous known incidents.

That convergence matters because attribution in crypto crime is rarely unanimous this quickly. North Korea's hacking teams have, according to current and former United States and South Korean officials, become a key source of revenue for the nuclear-armed, sanctions-battered regime. Pyongyang-linked hackers have stolen billions of dollars from banks and cryptocurrency firms in the last several years, according to reports from the United Nations and private firms. A 2023 CNN investigation spotlighted how South Korea's intelligence service worked with private crypto-tracking experts to seize about $1 million in cryptocurrency that North Koreans had stolen from a victim.

It is important to separate what the tracers say from what Binance itself says. Binance co-CEO Richard Tend said on X that the attack was not a "one-click" action, but rather a complex process, and that the investigation has not attributed responsibility to any individual. That careful wording leaves room for the tracing firms' conclusion while stopping short of a corporate accusation against a foreign government, a step with obvious diplomatic and legal consequences.

Reactions and Quotes

The FBI confirmed its involvement on Friday, saying in a statement that it is "aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps." In past investigations of big crypto hacks, the FBI has had an on-call team of analysts that worked to freeze some of the money, CNN reported.

The Secret Service went further on the operational detail. A spokesperson said the agency's "investigators are working around the clock with our private-sector partners, including Circle [the company behind the US dollar-backed stablecoin USDC], to identify, freeze, trace, and recover funds stolen from Binance on Thursday. We are also coordinating closely with the United States Attorney's Office for the District of Columbia and law enforcement partners to identify the cyber criminals responsible and bring them to justice."

Binance, for its part, repeated its central reassurance to users. The exchange said it would cover all losses from the company's funds and an emergency assets fund, adding that "user funds are safe." Co-founder Yi He had earlier said Binance would cover all hacking losses, and the company has promised an updated Proof of Reserves after remediation, plus a detailed technical post-mortem.

Why It Matters

If the North Korea attribution holds, the Binance North Korea hack becomes the largest known state-linked crypto theft in history, and a test of whether the global freeze-and-trace machine built after the Bybit heist can work at four times the scale. About $3 billion has already been frozen, according to the team of cryptocurrency firms working the case, but the other half is moving, and the Pangolin analyst's warning about laundering networks is a reminder that frozen funds and recovered funds are not the same thing.

The case also lands at a sensitive moment for crypto regulation. Exchanges hold customer assets directly, operate across borders, and still sit in a patchwork of national rules. A $6 billion breach attributed to a sanctioned state actor will sharpen arguments in Washington for tighter custody, disclosure and incident-reporting standards, and for sanctions enforcement against the wallets and mixers that launder the proceeds. For ordinary users, the immediate question is simpler: when withdrawals resume, and whether the "user funds are safe" pledge survives contact with the final loss tally.

Markets, at least, have steadied since the first shock. Prices of bitcoin and ether, the most widely traded cryptocurrencies, plummeted following news of the Binance breach, but regained some losses to trade about 2-3% lower midday Friday in Hong Kong, CNN reported. That partial recovery suggests traders are treating the event, for now, as a Binance-specific security failure rather than a systemic crypto crisis, though a failed recovery or a second wave of laundering could change that judgement quickly.

What Happens Next

Three clocks are now running. The first is Binance's own: the exchange expects withdrawal services to resume by Sunday morning, once security checks are completed and blockchain intelligence partners have traced and recovered what they can. Any delay past that target will be read as a sign that the damage is wider than first disclosed.

The second is the tracing clock. Chainalysis, TRM Labs, Pangolin Intelligence and their peers will keep following the stolen funds across chains, while the FBI, the Secret Service and the US Attorney's Office for the District of Columbia work to freeze and seize what they can. Past cases show this phase can last months, with funds surfacing in new wallets long after the headlines fade.

The third is the attribution clock. Formal United States government attribution, if it comes, would carry sanctions designations and diplomatic consequences that private-sector attribution does not. Until then, the careful distinction stands: tracing firms say North Korea, Binance says the investigation has not named an individual, and Pyongyang has previously denied hacking allegations.

Frequently Asked Questions

Did North Korea hack Binance?

Three crypto-tracing firms, TRM Labs, Chainalysis and Pangolin Intelligence, have linked the heist to a North Korean hacking unit, with Chainalysis expressing high confidence. Binance itself has not attributed responsibility to any individual, and the attribution has not yet been confirmed by the United States government.

How much was stolen in the Binance hack?

Binance estimates the total impact at about $6.3 billion. Crypto trackers put the figure at about $6 billion. About $3 billion has been frozen by crypto firms working with law enforcement and blockchain intelligence partners.

Are Binance user funds safe?

Binance says it will cover all losses from company funds and an emergency assets fund, and that user funds are safe. Deposits and withdrawals were temporarily suspended while security checks are completed, with resumption expected by Sunday morning.

What did the FBI and Secret Service say?

The FBI said it is aware of the incident and engaged with public and private partners. The Secret Service said investigators are working around the clock with partners including Circle to identify, freeze, trace and recover the funds, in coordination with the US Attorney's Office for the District of Columbia.

Why would North Korea steal cryptocurrency?

According to United States and South Korean officials and United Nations reports, North Korean hacking teams are a key revenue source for the sanctions-battered regime, and Pyongyang-linked hackers have stolen billions from banks and crypto firms in recent years.