Finance
“Hackers stole approximately $6.3 billion in cryptocurrency from the crypto exchange Binance starting Thursday, with multiple investigators pointing to North Korea as the likely culprit.”
Plain restatementOn Thursday 29 October 2026, an attacker moved roughly $6.3 billion in crypto assets out of Binance wallets, and more than one blockchain-analytics firm has publicly attributed the attack to North Korea.
General information only - not financial advice.
This one checks out. Binance confirmed on 30 October 2026 that a security incident caused unauthorized withdrawals with an estimated impact of about $6.3 billion, starting on Thursday 29 October 2026. The blockchain intelligence firm TRM Labs published its own report measuring roughly $6.36 billion moved out of Binance wallets across ten blockchains, most of it in about 20 minutes, and attributed the attack to a North Korean state-linked hacking unit, with Chainalysis reaching the same conclusion. Two things the short version leaves out are worth knowing. The $6.3 billion is the amount that moved, not the final loss: Tether, Circle and others have frozen roughly $2.5 billion to $3 billion of it on-chain, and Binance says it will cover losses from its own funds. Binance also temporarily suspended deposits and withdrawals as a precaution, which the post does not mention. The North Korea link comes from private analytics firms rather than from a government finding in the sources reviewed, and North Korea has historically denied such accusations.
[drifted from the evidence:] Hackers stole approximately $6.3 billion in [drifted from the evidence:] cryptocurrency from the crypto [drifted from the evidence:] exchange Binance [drifted from the evidence:] starting Thursday, with multiple investigators pointing to North Korea [drifted from the evidence:] as the likely culprit.
[added by the neutral restatement:] On Thursday 29 October 2026, an attacker moved roughly $6.3 billion in crypto [added by the neutral restatement:] assets out of Binance [added by the neutral restatement:] wallets, and more than one blockchain-analytics firm has publicly attributed the attack to North Korea.
Red-tinted words in the claim drifted from the evidence. Green-tinted words are what a neutral restatement needs.
The trace / claim to source
- Binance itself stated that a security incident resulted in unauthorized withdrawals with an estimated financial impact of about $6.3 billion, as of 30 October 2026.
- The incident began on Thursday 29 October 2026, consistent with the claim's "starting Thursday."
- TRM Labs measured approximately $6.36 billion moved out of Binance wallets across ten blockchains, most of it within roughly 20 minutes, on 29 October 2026.
- More than one investigator named North Korea: TRM Labs attributed the attack to the North Korean unit TraderTraitor with stated high confidence, and Chainalysis said it appears to be the work of the same group. The claim's hedged wording, "likely culprit," matches how those firms framed it.
- The post's supporting details check out against the record: the compromised engineer's laptop as the initial suspected entry point, roughly $3 billion frozen, Binance's pledge to cover all losses, and the FBI's 2025 attribution of the roughly $1.5 billion Bybit theft to North Korean actors.
- Binance has not named the attacker itself, which is consistent with the claim crediting the attribution to investigators rather than to Binance.
- The claim and the post describe $6.3 billion as stolen, while Binance describes it as the estimated financial impact and investigators describe it as the amount moved out of Binance wallets. Roughly $2.5 billion to $3 billion of that has been frozen or locked on-chain by Tether, Circle, Arbitrum and other issuers as of 30 October 2026, so the amount the attacker can actually use is materially smaller than the headline figure and the final net loss is not yet known.
- The post's reassurance section tells viewers not to worry and cites Binance's pledge to cover losses, but does not mention that Binance temporarily suspended deposits and withdrawals as a precaution. That suspension is the fact most directly relevant to a user trying to access funds today.
- Whether the final loss figure stays near $6.3 billion. Binance called the number an estimate, said its investigation uncovered additional points of breach, and said it will publish an updated Proof of Reserves once remediation is complete.
- The attribution to North Korea rests on analysis by private blockchain-intelligence firms. It is stated at high confidence by TRM Labs and echoed by Chainalysis, but it is not a government or court finding in the sources retrieved, and North Korea has historically denied such allegations.
- The precise intrusion path. Binance's initial finding pointed to a compromised DevOps engineer's laptop, but the company subsequently said additional points of breach were found and its co-CEO disputed the simple one-click framing.
- How much of the frozen or locked value is ultimately recovered and returned.
Binance confirmed in its own statement that a security incident produced unauthorized withdrawals with an estimated financial impact of about $6.3 billion. Binance said its initial investigation suggests a compromised DevOps engineer's laptop allowed an attacker to reach a service container and submit withdrawal transactions, that it found no evidence of wallet private key compromise, that roughly $3 billion in affected assets has been frozen on-chain with blockchain partners, and that it will cover all losses from its SAFU fund and company funds. Binance also said it temporarily suspended deposits and withdrawals, revoked the affected address authorisation, and engaged law enforcement. Binance later said its investigation uncovered additional points of breach beyond the laptop, and co-CEO Richard Teng disputed characterising the breach as a simple one-click compromise. TRM Labs published that an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains on 29 October 2026, most of it in about 20 minutes, and attributed the attack to TraderTraitor, a North Korean state-linked unit associated with the Lazarus Group, based on robust on and off-chain intelligence. Chainalysis separately said the incident appears to be the work of the North Korean group TraderTraitor. Reuters reported the TRM attribution and noted that North Korea routinely denies such allegations and that its Geneva mission and its embassy in China did not immediately respond to requests for comment. On-chain trackers report that Tether, Circle, Arbitrum's Security Council and several smaller issuers locked roughly $2.5 billion to $2.7 billion of the moved assets. For scale comparison, the FBI attributed the February 2025 Bybit theft of about $1.5 billion to the North Korean actor it tracks as TraderTraitor, which was the previous record for a single crypto theft.
Complete reasoning
The reply is formatted for pasting into the thread where the claim is circulating.
Ask this case
Answers come only from the case file above; nothing is added.
Did $6.3 billion actually get stolen from Binance?
Binance confirmed that about $6.3 billion moved out of its wallets in unauthorized withdrawals starting Thursday 29 October 2026. That figure is described as the estimated financial impact or amount moved, not the final confirmed loss, since roughly $2.5 to $3 billion has since been frozen on-chain.
Is North Korea confirmed to be behind the hack?
Two blockchain-analytics firms, TRM Labs and Chainalysis, publicly attributed the attack to the North Korean group TraderTraitor, linked to the Lazarus Group. This attribution comes from private investigators rather than a government or court finding, and North Korea has historically denied such accusations.
How did the hackers get in?
Binance's initial investigation pointed to a compromised DevOps engineer's laptop that let the attacker reach a service container and submit withdrawal transactions. Binance later said it found additional points of breach, and its co-CEO disputed describing it as a simple one-click compromise.
Can users still access their funds on Binance?
Binance temporarily suspended deposits and withdrawals as a precaution after the incident. This detail is important for anyone trying to access funds but is not mentioned in the original claim.
Will Binance customers lose money because of this?
Binance said it will cover all losses using its SAFU fund and company funds. The investigation does not yet establish the final net loss, since the $6.3 billion figure is an estimate and Binance plans to publish an updated Proof of Reserves once remediation is complete.