10
Loading video...
By Chris Matthews
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
The world’s largest cryptocurrency exchange has been hit by a record hack, putting hundreds of millions of people’s money at risk.
Binance said on Friday that suspected hackers had taken around $6.3 billion, which could make it the biggest ever crypto heist. A blockchain analysis firm blamed North Korea’s TraderTraitor hacking group for the breach—as Binance suspended withdrawals with the value of cryptocurrencies plummeting.
Kathryn Westmore, the director of financial crime at UK Finance, told Newsweek: “TraderTraitors [is] believed to be a state-sponsored North Korean hacking group who have carried out other hacks on other platforms, although not at the scale of the Binance hack.”
Read More on News
...
She said that although the hackers attacked Binance, users’ own security on their personal devices would have played a part in whether their wallets were targeted.
Westmore said: “It can be as complex and attack as you like, but it ultimately depends on a person’s device becoming compromised, whether with malware or something else.
“The human element is so interesting. So many hacks or cyber attacks start with a person doing it or doing something which ends up infecting their device and the network.”
Responding to today’s attack, Binance said its initial investigations of the “security incident” indicated that the laptop of a software engineer at the company may have been compromised, which allowed hackers into the platform’s systems and ultimately to green-light withdrawals.
Binance was hit with a crypto heist in 2022, when a hacker artificially created 2 million BNB tokens, amounting to around $570 million.
Although the platform stepped in, the attacker was still able to take around $115 million.
After this latest huge hack, Blockchain company TRM Labs said it had “high confidence” North Korean hackers were behind the attack.
It said: “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit. We make this judgment with high confidence.”
The group added: “We base this assessment on robust on and off-chain intelligence sources. The FBI named the same group as responsible for the $1.5 billion Bybit hack in February 2025.
“Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst.
“The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit.”
...
Meanwhile, intelligence analyst James Seyffart told Bloomberg: “Hot wallets [digital wallets connected to a live network] getting drained is not something new to crypto, but the amount would be a meaningful hack on the largest crypto exchange. It’s definitely a bad look. And this is one after another.”
BNB, formerly known as Binance Coin, dropped by more than 4.7 percent. Bitcoin fell approximately 4.5 percent to $76,368 before recovering to $78,434.
How the Heist Went Down
TRM believes the attack took around 36 hours to prepare, when the main operator got “three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting the morning of October 28.”
Then the hacker started the attack, using code to attack two wallets. The group tested the code on a third wallet before funnelling the money used back to their accounts.
Four hours later, the hack began.
In the space of just four minutes between 8:05 p.m. and 8:09 p.m., five Binance hot wallets sent 233.46 million of the cryptocurrency XRP to one of the hackers’ addresses. Each wallet was left with only its minimum balance.
One minute later, Binance wallets on Optimism and Solana were hit. At 8:20 p.m., a Binance Bitcoin hot wallet was taken over. The hackers sent themselves 18,270 BTC and split them into 1,000 BTC and 100 BTC pieces, a technique known as creating a "peel chain" that obscures the journey of funds. Finally, the attackers sent themselves 612.7 million USDT and 46.4 million TRX from a Binance hot wallet on Tron.
What Binance Users Should Do After Record $6.3 Billion Crypto Hack
Westmore told Newsweek: “It's highly likely that we're going to see a wave of fraudsters contacting potential victims and asking for payment to help them get their money back (which they can't do). Based on the statements from Binance, their money should be safe.
“However, we don't know what, if any, personal data may have been breached, so people should monitor for any signs that their personal data is being used by criminals or has been sold.”
Binance have said it will cover the costs of the massive hack.
Although he no longer runs the company, Binance co-founder Changpeng Zhao said on X: “I expect all user funds will be fully recovered.” He added: “It does look like a hack on Binance.”
Zhao was pardoned for money laundering charges by President Donald Trump in 2025. At the time, the president's use of executive clemency drew criticism from former U.S. Pardon Attorney Elizabeth G. Oyer and renewed questions about political influence over the Justice Department.
Tether CEO Paolo Ardoino said his firm has frozen over $1.56 billion “related to a potential Binance exchange hack,” while Circle chief Jeremy Allaire said his firm had frozen more than a million USDC.
Contact Newsweek editors on this story: Matthew Robinson and Emma Lee-Sang
View 0 Comments
Submit Correction
View Editorial & AI Guidelines