Suspected North Korean Hackers Linked to $6.36bn Binance Security Breach
Blockchain intelligence firms point to an alleged state-linked hacking group as the cryptocurrency exchange pursues asset recovery and reviews security vulnerabilities.
October 30th,2026
GLOBAL – A reported security breach involving approximately $6.36 billion in digital assets at Binance, the world’s largest cryptocurrency exchange, has heightened concerns over cybersecurity risks in the digital finance industry, with blockchain intelligence firms suspecting links to a North Korean-associated hacking group.
The incident reportedly involved transactions across 10 blockchain networks, with much of the movement occurring within approximately 20 minutes. If confirmed at the reported scale, the incident would rank among the largest cryptocurrency thefts on record.
Blockchain intelligence firm TRM Labs attributed the suspected attack to TraderTraitor, a hacking operation linked to North Korea that has been associated with attacks against cryptocurrency platforms and digital asset infrastructure. The assessment reportedly drew on similarities between the incident and previous attacks attributed to the group, including the $1.5 billion breach involving cryptocurrency exchange Bybit in 2025.
Chainalysis, another blockchain analytics firm, also assessed that the suspected perpetrators were likely connected to the same North Korean-linked network. However, Binance has not independently confirmed the identity of those responsible and said it was working with law enforcement agencies and industry partners to investigate the incident.
In its response, Binance reportedly worked with blockchain partners to freeze approximately $3 billion in affected assets and initiate recovery efforts. The exchange also stated that customer deposits were unaffected, although withdrawals were temporarily suspended during the security investigation. It assured customers that losses would be covered.
Preliminary findings reportedly pointed to a compromised laptop, while subsequent investigations identified additional potential entry points into the exchange’s systems. Binance maintained that there was no evidence that users’ wallet private keys had been exposed and said further technical information would be released when the investigation was completed.
The incident has renewed scrutiny of the security arrangements used to protect digital assets, particularly those held in hot wallets connected to the internet. Cybersecurity specialists have raised questions about access controls, transaction authorisation procedures and the safeguards designed to prevent unauthorised transfers.
Cybersecurity executive Kok Tin Gan also questioned whether weaknesses in transaction approval mechanisms could have enabled an attacker to gain extensive access to a Binance hot wallet.
The reported breach adds to wider international concerns about cryptocurrency-related cybercrime. North Korea-linked hacking groups have been repeatedly associated with attacks on digital asset platforms, with stolen cryptocurrency identified by investigators as a source of funds for activities linked to the country.
For cryptocurrency exchanges, the incident underscores the challenges of securing large volumes of digital assets against increasingly sophisticated cyber threats while maintaining uninterrupted services and customer confidence.
The reported Binance incident highlights the financial, operational and reputational risks facing businesses in the digital asset industry. Major security breaches can disrupt transactions, trigger regulatory scrutiny and weaken investor confidence, even when an exchange commits to covering customer losses.
For fintech companies, cryptocurrency exchanges and other digital financial service providers, the case reinforces the need for robust cybersecurity infrastructure, independent security assessments, multi-layer transaction approvals, continuous threat monitoring and clearly defined incident-response procedures.
It also highlights the importance of transparent communication with customers and effective cooperation with regulators, law enforcement agencies and blockchain analytics firms when security incidents occur.
As digital finance continues to expand, businesses’ ability to protect customer assets and demonstrate operational resilience will remain critical to building sustainable investor confidence.
Edited by Rosemary Aiyenale
Source: The Associated Press (AP)
