On Thursday, October 29, 2026, Binance reported that digital assets worth approximately $6.3 billion had been stolen from its hot wallets. This figure dwarfs the previous record of $1.5 billion taken from Bybit in February 2025.
Hot wallets store tokens whose private keys remain connected to the internet to enable instant withdrawals and trading. While convenient for users, this architecture also exposes the keys to remote compromise. The stolen assets were not customer account balances but tokens held in exchange-controlled storage.
Two days later the FBI attributed the theft to the TraderTraitor group, assessed as part of North Korea’s intelligence apparatus and commonly known as the Lazarus Group. Investigators stated that the proceeds were being converted to Ethereum and prepared for laundering via decentralized finance protocols and instant exchangers.
Coverage versus Recovery
Binance announced that 90 percent of losses had been “covered.” This means the exchange used its own funds to repurchase equivalent assets and return them to users. It does not indicate that 90 percent of the stolen tokens were seized from the attackers. No such recovery has been reported.
Funds came from the SAFU reserve (approximately $1 billion in Bitcoin), the futures insurance fund, and corporate treasury holdings. In total, Binance earmarked roughly $6.34 billion of its own capital. The ten most liquid assets—BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC—were restored to 100 percent. The remaining 10 percent, consisting of less liquid tokens, are being acquired gradually through market purchases and OTC desks.
Attack Mechanics
Initial reporting pointed to a single compromised laptop belonging to a DevOps engineer. Attackers used that access to reach a signing container and authorize unauthorized withdrawals. Subsequent statements from co-CEO Richard Teng indicated a more sophisticated operation that included anti-forensic malware designed to slow investigators.
TRM Labs blockchain analysis highlighted operational parallels with earlier incidents at Bybit (2025) and KelpDAO (April 2026). Small preparatory withdrawals through Tornado Cash funded operator wallets well in advance, and signatures were obtained and executed in a single coordinated action rather than a real-time exploit.
Strategic Implications
United Nations experts have previously estimated that cryptocurrency thefts supplied roughly half of North Korea’s foreign-currency earnings between 2017 and 2023. One unnamed member state assessed that such proceeds financed approximately 40 percent of the country’s weapons-of-mass-destruction programs. With traditional banking channels blocked by sanctions, crypto remains a critical funding vector.
Former UK National Cyber Security Centre head Ciaran Martin noted that over the past decade more than thirty cryptocurrency heists have netted nine- or ten-figure sums, while traditional banks have suffered comparable losses on zero or one occasion. The absence of mandatory audits, regulatory oversight, and standardized freezing procedures leaves exchanges more exposed than conventional financial institutions.
The event registered under criterion D5.2 “Cyber Operations” in the Cassandra Index. The driver score rose 2.3 percentage points, contributing 9.5 points to the weekly index total of 72 (+4). East Asia recorded the largest regional increase, reaching 74 (+10), reflecting the combination of the Binance theft, North Korean missile tests, and drone activity.
