AI-generated illustration
The Binance heist now has a suspect. The FBI says North Korean hackers carried out the October 29 attack that took about $6.3 billion in crypto from the exchange. That is an enormous amount to lose in one go, and it is hard to picture how it moved so fast.
Here’s the thing: most of the money left the platform in about 20 minutes, according to blockchain firm TRM Labs. Binance says it has since replaced about 95 percent of the stolen assets. Whether you use the exchange or not, the case says a lot about how crypto platforms get hit.
What the FBI says
In an alert published Saturday, October 31, the FBI linked the attack to TraderTraitor, a North Korean operation tied to the Lazarus Group. The agency says the attackers have started converting the stolen funds into Ethereum. It expects them to move the money through decentralized finance platforms and instant swap services, which are harder to trace.
To slow them down, the FBI published wallet addresses connected to the theft. It asked exchanges, blockchain analytics firms, and other crypto businesses to block transactions involving those funds. SecurityWeek later reported that the agency flagged more than 600 addresses tied to the heist. That is a lot of wallets to watch, and each one is a chance to freeze money before it disappears.
How the attackers got in
Binance says the attack began with a compromised laptop belonging to a DevOps engineer. That single machine gave the intruders access to a service container. From there, they could approve withdrawals they should never have been able to make.
I find this the most unsettling part. A stolen work laptop turned into a multibillion-dollar problem. It didn’t need a dramatic zero-day or a direct break into the exchange’s core systems. Security teams spend most of their energy guarding the front door, and this case points at the side door, the everyday tools engineers use to get their work done.
How much was taken and how Binance is responding
Estimates of the loss vary. Binance says about $6.3 billion was taken. TRM Labs puts it at $6.36 billion, and Elliptic estimates about $6.43 billion. Elliptic says it has verified $2.85 billion frozen or seized so far, which is the number to watch as the story develops.
Binance suspended withdrawals after the attack and has resumed them in phases. The company says it has replaced about 95 percent of the stolen assets using its own reserves and emergency funds. The remaining tokens are harder to replace because they have limited liquidity. Binance also reported about $3.64 billion in net outflows after withdrawals resumed, which it puts at roughly 2.1 percent of its reported assets.
Co-CEO Richard Teng has said customers will not be left paying for the loss. Whether that promise holds will depend on how the reserves hold up over the coming weeks.
What you should do if you use Binance
Binance’s own statements don’t give users specific security steps, so treat these as general precautions. First, always type the exchange address yourself or open the official app, and bookmark the real site. Phishing pages often copy the login screen almost exactly.
Second, be suspicious of any message claiming to come from support, especially one that asks for your password, two-factor codes, or seed phrase. Legitimate support staff never need those. Third, switch two-factor authentication to an app or a hardware key if you still rely on SMS codes. Finally, check your account activity and withdrawal history for anything you don’t recognize, and act quickly if you spot it.
Why this matters beyond Binance
This attack fits a pattern. North Korean groups have used fake job offers to trick employees into giving up access, and they have targeted other exchanges before. Japan’s DMM Bitcoin lost $308 million to a TraderTraitor operation in 2024. Binance itself was hit in 2022, when attackers took about $566 million from its BNB blockchain bridge.
Bitget has also said its $387.5 million loss shows hallmarks of a North Korean operation. For readers, the lesson is simple. An exchange is only as secure as the laptops and tools its staff use every day. Don’t assume the platform’s security covers everything you do.
Crypto platforms have been hit hard lately. Our recent coverage of the Polymarket trading pause shows how quickly funds can disappear.
Developing story: this post will be updated if the FBI or Binance releases new details on the stolen funds.
Sources: The Register, and SecurityWeek
