Binance confirms $6.3 billion hack as analysts point to North Korea's Lazarus
Author: Crypffalo Research · 15:06 30/10/2026
Binance says about $6.3 billion was stolen from its hot wallets and pledges to cover all losses. TRM Labs and Chainalysis link the attack to North Korea's TraderTraitor; $1.53 billion in positions were liquidated.
Binance has confirmed that roughly $6.3 billion in assets was stolen in an attack on its hot wallets that began around 20:24 UTC on Oct 29. It is the exchange's first official tally, above the $5.7 billion to $5.9 billion estimated onchain earlier.
The exchange says about $3 billion has been frozen and that it will cover all user losses. Blockchain analytics firms TRM Labs and Chainalysis both say North Korea's TraderTraitor, a Lazarus Group subunit, is the likely culprit.
Key takeaways
- Losses: Binance puts the theft at about $6.3 billion; Chainalysis estimated roughly $5.9 billion at the time of the outflows.
- Frozen: about $3 billion, including $2.3 billion in USDT and USDC.
- Initial cause: a compromised DevOps engineer's laptop let the attacker reach a service container and submit unauthorized withdrawals.
- Suspects: TRM Labs and Chainalysis point to TraderTraitor (Lazarus); Binance has not formally attributed the attack.
- Withdrawals: expected to resume within 48 hours; bitcoin fell as low as about $76,460; roughly $1.53 billion in positions were liquidated over 24 hours.
What Binance has said
In an update late Thursday, Binance said its initial findings point to a compromised laptop belonging to a DevOps engineer. The attacker used it to access a service container and push through unauthorized withdrawal transactions.
Binance said it has found no evidence of a wallet private key leak. However, CoinDesk's review of Etherscan data shows the attacker used EIP-7702 delegation to turn the "Binance 14" wallet into a sweeper, so the exact mechanics are still being pieced together.
Co-CEO Yi He said the exchange will cover "all hacking losses" and that user funds are safe. According to CoinDesk, compensation will come from the SAFU fund, worth about $1 billion in bitcoin, and company capital. She also said Binance expects to begin resuming withdrawals within the next 48 hours, adding that deposits are unaffected.
Where the money went, and what was stopped
Etherscan data compiled by CoinDesk shows about 204,500 ETH left the Binance 14 and Binance 16 wallets. Arkham data shows the attacker's wallets at one point held more than $5.7 billion, including nearly $1.5 billion in BTC, $900 million in ETH, about $1.5 billion in USDT and more than $800 million in USDC.
Stablecoin issuers moved quickly:
- Tether: CEO Paolo Ardoino said the company froze more than 1.567 billion USDT.
- Circle: CEO Jeremy Allaire said Circle froze more than $800 million in USDC in coordination with law enforcement.
- First Digital: confirmed the stolen FDUSD has been frozen, without giving an amount.
Bitcoin is a different story. CoinDesk reports the attacker split about $1.4 billion worth of BTC across 19 wallets, an asset no issuer can freeze.
Who is behind it?
TRM Labs said it has "high confidence" that TraderTraitor, a Lazarus subunit, carried out the attack. Chainalysis CEO Jonathan Levin said it "was likely done" by the same group, citing links to a previous hack.
Onchain sleuth ZachXBT and Blockaid's CEO reached similar conclusions. Still, a person familiar with crypto investigations told CoinDesk the attribution to Lazarus is not yet definitive.
What it means for crypto markets
Bitcoin dropped about 5% as the news broke and slid to around $76,460 early on Oct 30 before recovering toward $78,500. Ether briefly fell below $2,200 and was trading near $2,240.
CoinGlass data cited by CoinDesk shows about $1.53 billion in positions liquidated over 24 hours, nearly 84% of them longs. Binance alone accounted for about $755 million.
- Bull case: a smooth withdrawal restart, the return of frozen funds and a reserve report showing full backing could steady sentiment.
- Risk case: a prolonged withdrawal halt or a reserve shortfall could fuel a run on centralized exchanges and add selling pressure.
Standard Chartered's Geoffrey Kendrick said the negative price action "still has some way to go" and that a new base will only form once more details emerge. CoinDesk estimates the stolen ETH equals about 5.6% of Binance's ETH reserves.
What to watch next
- Whether Binance reopens withdrawals within the promised 48 hours.
- The detailed technical post-mortem Binance has promised.
- The Nov 1 Proof of Reserves snapshot, which should show whether the stolen assets have been replaced.
- Law enforcement action and the release of frozen funds.
- Track positioning on our real-time liquidations page and macro dates on the economic calendar.
Frequently Asked Questions
Are Binance users' funds lost?
Binance and co-CEO Yi He say user funds are safe and that the exchange will cover all losses from SAFU and company capital. The Nov 1 reserve snapshot will offer a clearer check.
Why could USDT and USDC be frozen but not BTC?
USDT and USDC are issued by companies that can freeze specific wallet addresses. Bitcoin has no central party with that power.
Has Lazarus been confirmed as the attacker?
Not yet. TRM Labs and Chainalysis say they have high confidence, but neither Binance nor authorities have issued an official finding.
*This content is for information only and is not financial advice.*
Tags: Binance, Hack, Lazarus, Security, Bitcoin
Related articles
- Trump says US looking into Binance hack as CFTC chair pushes offshore oversight
- Binance targets Nov 1 withdrawal restart after finding more breach points in $6.3B hack
- Crypto stocks slide: Coinbase drops 12%, Strategy 11% as Binance hack weighs
- Binance sets aside $6.34 billion in corporate funds to cover hack losses
- Bitcoin Falls Below $77,000 as Binance Hack Triggers $1.5B in Liquidations
- Binance Halts Withdrawals on Several Networks After Suspected Hack; CZ Expects Full Cover