North Korean hackers purportedly stole an estimated $6.36 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange, on October 29, 2026, marking what would be the largest cryptocurrency theft on record. Blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean hacking group.Most of the funds were stolen in approximately 20 minutes, according to TRM Labs. The firm expressed high confidence in TraderTraitor’s involvement, citing analysis of cryptocurrency transactions and similarities with previous North Korean hacking operations. Richard Teng, co-CEO of Binance, stated that the company is committed to covering all hacked losses through its funds, reserving over $6.34 billion for this purpose, with $5 billion already held in the impacted token assets.The hackers began preparing for the attack at least 36 hours in advance, gaining access to systems used to authorize cryptocurrency transfers, which allowed them to move funds without permission, TRM Labs reported. Binance temporarily suspended deposit and withdrawal services to complete security checks and facilitate the recovery of funds, with withdrawal services expected to resume by Sunday morning.Approximately $3 billion of the stolen assets have been frozen through cooperation among cryptocurrency companies and blockchain operators. Circle confirmed freezing over $800 million in USDC related to the incident, while Tether froze more than $1.5 billion in USDT. Arbitrum’s security council also froze 8,426 ETH and 74.6 million ARB on its network. However, the hackers still control roughly $2.4 billion worth of Bitcoin and Ethereum.The U.S. Federal Bureau of Investigation (FBI) and the U.S. Secret Service are collaborating with Binance in the ongoing investigation. On October 30, 2026, the FBI stated it was aware of the incident and coordinating with partners to understand the scope, evaluate potential impacts, and coordinate investigative steps. U.S. President Donald Trump also acknowledged that law enforcement authorities were pursuing the case.Cybersecurity experts highlight that North Korean hackers, particularly TraderTraitor, are among the world’s most prolific crypto thieves. These groups often use malware, fake job offers, and fake interviews to target developers and IT staff at financial institutions, stealing login credentials and sensitive data. The proceeds from these thefts are believed to fund North Korea’s weapons of mass destruction programs and other military objectives, a concern echoed by U.S. officials and a State Department spokesman.This attack far exceeds previous major thefts, such as the $1.5 billion stolen from Bybit in February 2025, also attributed to TraderTraitor. Chainalysis reported that North Korea had stolen at least $6.75 billion in cryptocurrency by the end of 2025. The group also hit Bitget in September, taking $387 million. Michael Barnhart, a researcher with cybersecurity firm DTEX, noted that after the Bitget incident, many in the community anticipated another major attack.Binance aims to publish a full proof of reserves by Monday and will share a detailed technical post-mortem once security checks are complete and facts are fully verified. The FBI and U.S. Secret Service will continue their investigation, and Chainalysis is committed to assisting Binance and the broader industry in tracing the stolen funds and preventing further money laundering.
Background
- North Korean hackers are often accused of engaging in cryptocurrency theft to fund their nuclear weapons programs and other military objectives.
- TraderTraitor, believed to be part of the Lazarus Group, was mentioned in a 2022 joint warning by the FBI, CISA, and the U.S. Treasury.
- In February 2025, TraderTraitor stole $1.5 billion from the Bybit exchange, an incident the FBI attributed to North Korean hackers.
- Chainalysis reported that North Korea had stolen at least $6.75 billion in cryptocurrency by the end of 2025.
Why it matters for Nepal
In Nepal, cryptocurrency is entirely illegal and prohibited. Nepal Rastra Bank, the central bank, has imposed a complete ban on all cryptocurrency-related activities, including Bitcoin, Ethereum, stablecoins (USDT), NFTs, and DeFi tokens. Violators can face up to seven years in prison and fines up to three times the transaction value, due to concerns over financial stability, consumer protection, money laundering, and cybersecurity threats. There is no direct impact of this specific hack on Nepal, given the country's strict prohibition on cryptocurrency.
