Executive Summary

Key Figures

Sources: TRM Labs and Elliptic analysis, and TechCrunch reporting.

At 20:05 UTC on October 29, 2026, around 05:05 the following morning in Korea, assets in Binance wallets began moving to addresses the attacker controlled. Ten blockchains were involved, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger, and most of the money was gone within 17 to 20 minutes. One exchange's assets moved on ten separate ledgers at the same hour.

The size explains why this entered the record books. TRM Labs' tally is about $6.36 billion. The previous largest, the Bybit hack of February 2025, came to roughly $1.5 billion, so this cleared four times that mark in one go. Nothing on this scale has left a single exchange in a single day before.

The table below gathers the moments that can be confirmed from published material. The ones given to the minute are there because blockchains record the time of every transaction, and the freeze times are values Elliptic worked back from the chain records.

Sources: TRM Labs and Elliptic analysis, with reporting from CoinDesk and Etoday. Freeze totals shift with the moment they are counted.

When an exchange is robbed, the private key is usually the first thing that comes to mind. Ownership of a crypto asset is proven by that secret value, and whoever holds it can move the asset. Yet what Binance described in its first findings was not a key leak. A DevOps engineer's laptop was compromised, and the attacker used it as a foothold to reach service containers and submit unauthorized withdrawal transactions.

The distinction matters. When a private key leaks, the attacker creates the signature. Here the attacker never needed to. By taking over the internal path that accepts a withdrawal request and sends it out with a valid signature attached, the attacker produced withdrawals that, seen from the blockchain, were indistinguishable from transactions Binance sent itself. It is less like breaking the lock than like reaching the position that gives orders to the staff who hold the keys.

That account changed once within a day. Co-CEO Richard Teng said this was not one person's work and that the stolen laptop was only an early lead, revising the account to say a wider breach had surfaced in further investigation. The phrase the company used was a complex attack. What is public now is a summary of the first round, and a more detailed technical report has been promised for later.

Preparation ran far ahead of the attack. The attacker withdrew small amounts from Tornado Cash, a mixer that obscures where funds came from, to pre-fund the wallets used in the operation, and that work was finished at least 36 hours in advance. The method is to fund operator wallets through a mixer, collect the signatures in advance, and release them all at once. TRM Labs reads that as the same frame used in the Bybit hack and in the KelpDAO hack of April 2026.

A close relative of this case occurred a month earlier. On September 24, 2026, $351.6 million left the exchange Bitget through hot and warm wallets, by TRM Labs' count. No private key leaked there either. Bitget's account was that the attacker took over the wallet backend system, swapped out the transfer details, and then passed the exchange's own approval and signing procedure untouched. Seizing the point where the signature is issued makes it the same frame as what happened at Binance.

The attack itself was near flawless, and what followed was not. Less than 24 hours after the money went out, three blockchain analytics firms each named a North Korea-linked group. Had this happened in traditional finance, simply confirming the flow of funds would have taken warrants in several countries and several months.

The reason for the speed lies in the nature of the data rather than in investigative muscle. A blockchain is built so that every transaction is public, cannot be erased once written, and is chained in time order. Which address sent how much to which address and when is held in a ledger open to anyone. The analytics firms draw a graph on top of that ledger, addresses as nodes and transactions as edges. Clusters of addresses already labeled North Korea-linked from earlier incidents were sitting inside that graph.

Chainalysis caught the decisive moment. Funds leaving Binance were mixing, in real time and on chain, with funds from the Bitget hack of September 2026, a month earlier. Chainalysis had already classified the Bitget case as TraderTraitor's work. That the money from the two incidents flowed into the same wallet system and merged there became, in itself, evidence of a single actor.

The other two pointed the same way. TRM Labs set on-chain records beside off-chain information and concluded the attack was TraderTraitor's work, writing that it held high confidence. TraderTraitor is understood to be an elite unit under the Lazarus Group, which the US Treasury has designated. It is also the name the FBI used when it formally identified the party behind the Bybit case in February 2025. Elliptic's own analysis found the same group likely. ZachXBT, an independent blockchain investigator, also said Lazarus was the likely answer.

Not everyone held the same degree of confidence. CoinDesk carried the observation that, measured against this group's usual behavior, the funds are being moved and cashed out slowly. Attribution is a judgment that weighs evidence, and the phrases the analytics firms used were high confidence and likely. That sits on a different level from a fact settled in court.

Background figures support the conclusion as well. Chainalysis estimates that about 89% of crypto hack losses in 2026 are tied to North Korea. The average loss per North Korea-linked attack has climbed from $50.65 million in 2021 to $185.65 million in 2026, meaning the amount taken in a single go has grown faster than the number of attacks.

Fast tracing makes fast response possible. The exchange, though, was not the party that actually halted the money sitting in the attacker's wallets. Tether and Circle, the stablecoin issuers, followed those wallets in real time and locked the assets down. By Elliptic's analysis, Tether froze the 118 million USDT in the first wallet about 37 minutes after the attacker moved the funds, then locked four more addresses within 17 minutes of that first freeze. That second stretch of 17 minutes is a different window from the 17 minutes the money took to leave.

The reason this is possible lies in how stablecoins are built. USDT and USDC are assets whose ledgers the issuer operates, so when the issuer locks a given address, the coins held there stop moving. Bitcoin and Ether have no such mechanism. The attacker spread the funds across several blockchains, and the portion held as stablecoins was locked by a single decision at the issuer.

Changpeng Zhao, Binance's founder, thanked Tether and Circle for freezing roughly $971 million and $823 million respectively at speed. He added that while he no longer runs Binance.com, he expects full compensation as a shareholder. As of October 31, the amount locked through industry coordination was counted at $2.8–3.0 billion, with about $3.3 billion estimated to be still unfrozen.

Sources: Elliptic analysis with reporting from TechCrunch and CBS News. Frozen amounts vary by the moment and the body doing the counting.

Binance's own response came the same day. Co-CEO Yi He said the company was investigating a security problem and that user funds were safe, and that the losses would be covered in full out of company funds. Deposits and withdrawals were suspended for security checks, asset freezes and cooperation with law enforcement, with a plan to resume withdrawals within 48 hours.

What draws attention is the way that responsibility was acknowledged.

We got a great deal wrong. We should have invested in security earlier and more heavily, and should have set stricter standards.

Yi He, Binance co-CEO. The English here is rendered from the Korean translation SBS carried, not from the original remarks, which this article could not verify in their original wording.

An exchange that has held first place worldwide with a market share around 40% is conceding that it underinvested in security. It also means the company with the most money and the most people to spend on the problem still came up short in this particular place.

On the morning of October 30 in Korea, the domestic exchanges put up notices one after another. Upbit posted at 07:46 that it had confirmed signs of digital assets being stolen in a Binance security incident and told users to take particular care when withdrawing to Binance, and Bithumb and Coinone issued similar notices around 08:00. All three added that they could restrict withdrawals bound for Binance if needed, and that they could cooperate with asset freezes under legal process.

One point needs stating clearly. These notices do not mean the Korean exchanges were breached. No sign has been confirmed that customer assets at Upbit, Bithumb or the others were directly stolen. The notices target two indirect risks instead. One is that assets sent to Binance during the cleanup period may be locked up or delayed. The other is the fake compensation-claim sites that always follow an event like this, hunting for personal wallet details.

• • No direct loss to Korean customer assets has been confirmed. The notices are guidance about withdrawals heading out to Binance, not announcements of a breach at the Korean exchanges themselves
• • The indirect effect arrived first through prices. Major coin prices wobbled right after the incident, leaving Korean investors with paper losses
• • Fake compensation-claim sites deserve caution. Phishing that imitates the full-compensation announcement can start circulating the moment that announcement lands. Checking compensation guidance only through an exchange's official channels is the safer course

The regulators moved in the same week. On October 28, the day before this incident, the Financial Services Commission held an emergency review meeting with the Financial Supervisory Service and the Financial Security Institute over hacking incidents at major crypto operators including Bithumb, and opened on-site inspections. The schedule had been set before the Binance incident, but the weight of the review changed once the world's largest exchange was breached immediately afterward. The commission said it would push to make bank-grade security measures mandatory for the crypto sector as well, which currently falls outside the Electronic Financial Transactions Act.

Memory is part of why the Korean industry takes this case so seriously. On November 27 last year, 24 Solana-family assets worth about 44.5 billion won left Upbit for wallets nobody had designated, and the North Korean hacking group Lazarus was named as the likely party behind it. The exchange had also lost some 340,000 ether worth about 58 billion won on November 27 in 2019. The security outlet Boannews called it a hack that had recurred six years to the day.

What separates that case from this one is recovery. In the Upbit incident the hacker was tracked converting all of the stolen assets into Solana, and by the count taken right after the event, Upbit had completed freezes on 2.3 billion won of the 44.5 billion. Solana has no issuer freeze mechanism of the kind described in Section 4. Set that against the Binance case, where Tether and Circle alone account for more than $1.7 billion of the $2.8–3.0 billion frozen, and the gap is plain.

A breach at one exchange does not stop at that exchange's customers. It reaches the withdrawal policies of other exchanges and the calendars of financial regulators, and this case confirmed that again.

Three days in, most of what is public remains provisional. Four conditions are worth knowing before anyone repeats the numbers.

• • The loss is an estimate and differs between institutions. The $6.36 billion used in this article is TRM Labs' figure, and other counts put it in the $6.4 billion range. Converted into other currencies, the spread widens further with the exchange rate
• • The attack path rests on the victim's own announcement. The laptop and the service containers come from Binance's first findings, and the company revised that within a day to call it a complex attack. The detailed technical report has not appeared yet
• • Attribution is a judgment, not a settled fact. Three analytics firms reached the same conclusion, but they wrote in terms of confidence and likelihood rather than certainty, and a note of caution based on the pace of laundering came with it
• • The frozen total changes with the moment it is counted. The $2.8–3.0 billion is the tally as of October 31, and further freezes or upward revisions may follow

A line about sources belongs here too. Among Korean coverage, this article took the SBS report as its reference for the Korean side of the facts, and checked the international figures against the published analysis from TRM Labs and Elliptic and against reporting from TechCrunch, CoinDesk, CNBC and CBS News. Figures for last year's Upbit incident and September's Bitget incident were confirmed separately in a Boannews column and in TRM Labs' analysis. A video covering the same event matched the SBS article in title and content, but the posting details of the video itself could not be verified, so the facts in the body follow the article.

Two scenes about data overlap in this incident. In one, data exposed the culprit. In the other, data access control collapsed and the incident began. They are the front and back of the same event, and they point in opposite directions.

Take the exposing side first. The blockchain narrowed the culprit in a day less because the analytics firms are exceptionally skilled than because that ledger is public, immutable and chained in time order. Where records have that structure, reconstruction after the fact is possible. Put the other way, no analysis tool, however good, can do the same work when records are broken or rewritable. Accuracy and missing-value rates come to mind first in any conversation about data quality, but traceability is the quality attribute that only gets priced after something goes wrong.

The side that collapsed is more ordinary. The attack began not with cryptography or a consensus algorithm but with one engineer's laptop. That the path from that laptop reached all the way to the internal machinery that issues withdrawals means it was never narrowed enough to say which account reaches how far into which system. Even in a system with billions riding on it, the place that gave way was the most everyday piece of access management.

So the incident leaves three questions for anyone responsible for data.

• • Are our records shaped so they can be walked back after an incident? Tracing only works when who changed what and when is recorded and that record cannot later be edited. The blockchain is not special; it simply wrote those two conditions into its design
• • Have we counted permissions by path rather than by person? What went wrong here was not the engineer's permissions as such but the path running from that endpoint to the place where withdrawals are created. A list of accounts does not show that path
• • Do we have a test for requests indistinguishable from legitimate ones? A withdrawal carrying a valid signature cannot be filtered on form alone. There has to be a separate test that reads the distribution of the data: unusual volume and speed, unusual destination addresses

This layer is what Pebblous is addressing when it talks about AI-Ready Data. Data a model can work with is not only data with a tidy schema; it is data that still carries where it came from and who touched it. This incident is close to the most dramatic demonstration yet of what becomes possible when that history is intact.

Thank you for reading this far. The primary analysis this article leans on is the published work of TRM Labs and Elliptic, and the rest of the sources are gathered in the references below. When the detailed technical report Binance has promised arrives, we intend to revisit the attack path. If you are willing to share how your own organization reviews its data access paths, we would be glad to hear it.

Pebblous Data Communication Team
October 31, 2026

Primary Analysis Reports

• 1.TRM Labs. (2026). "North Korea Steals $6.36 Billion From Binance in the Largest Hack in History." TRM Labs Blog.
• 2.Elliptic. (2026). "Binance: The Largest Hack in History." Elliptic Insights.

International Coverage

• 3.TechCrunch. (2026). "North Korean hackers blamed for stealing record $6.3B in Binance breach."
• 4.SecurityWeek. (2026). "$6 Billion Binance Hack Bears Hallmarks of North Korea's TraderTraitor."
• 5.CNBC. (2026). "Billions in crypto frozen in Binance hack — here's what happens next."
• 6.The Defiant. (2026). "Chainalysis Links $6.4 Billion Binance Hack to North Korea."
• 7.CoinDesk. (2026). "Crypto's Longtime Foe North Korea's Lazarus Group Likely Behind Binance Hack: Blockchain Sleuths."
• 8.crypto.news. (2026). "North Korea crypto hack losses 2026: Chainalysis report."
• 9.CBS News. (2026). "Binance hack linked to North Korea."

Korean Coverage

• 10.SBS News. (2026). "'세계 최고' 1위 기업도 무너졌다…한국 비상 걸린 이유" (The world's No. 1 company has fallen — why Korea is on alert).
• 11.Etoday. (2026). "업비트·빗썸·코인원, 바이낸스 해킹에 출금 주의 공지" (Upbit, Bithumb, Coinone issue withdrawal warnings after Binance hack).
• 12.The Economist (Korea). (2026). "바이낸스 해킹 사태, 금융당국 긴급 점검" (Financial regulators hold emergency review after Binance hack).
• 13.NewDaily Biz. (2026). "바이낸스 역대 최대 해킹, 국내 거래소 파장은" (Binance's largest-ever hack and its ripple effects on Korean exchanges).
• 14.BoanNews. (2026). "6년 만에 재현된 업비트 해킹" (The Upbit hack repeated six years later).