'Elite North Korean hackers' blamed for $6.3B Binance hack

Binance freezes withdrawals after $6.3bn security breach

Digital assets worth more than $6.3bn (£4.7bn) have reportedly been taken from Binance by North Korean hackers, apparently after a laptop belonging to one of its engineers was hacked.

“Rest assured that user funds are completely safe,” a Binance spokesperson said in a statement.

Binance said it had worked with partners to ⁠freeze the affected assets, with about $3bn ⁠located so far. It gave no update on ​the status of the remaining $3.3bn as Binance co-founder Yi He said the company would cover “all hacking losses”.

Key events4m agoUK financial watchdogs monitoring fallout from Binance heist3h agoBinance ‘working closely’ with law enforcement.3h agoBinance's Teng: Your money is safe3h agoElite North Korean hackers blamed for Binance theft3h agoBitcoin and crypto firms hit by Binance breach3h agoBinance freezes withdrawals after $6.3bn security breach3h agoIntroduction: UK house price growth slowest since January 2024

• 3h agoBinance ‘working closely’ with law enforcement.

• 3h agoBitcoin and crypto firms hit by Binance breach

UK financial watchdogs monitoring fallout from Binance heist

Kalyeena Makortoff

double quotation mark“While Binance wasn’t registered with the FCA to provide crypto services in UK, we’re aware of the reported incident and engaging with them to understand the impact.”

While crypto firms are not regulated in the UK, the Bank of England and FCA will be keeping an eye on any banks, insurers or fintechs that are exposed to Binance, and how that could ultimately hurt the UK’s wider financial system.

The Bank of England is monitoring the Binance hack, according to a source familiar with the matter. However, it is understood there is no active concerns. The Bank of England declined to comment.

Justas Pukys, senior product manager at Surfshark, a cybersecurity company), reckons Binance customres shuold watch out for a potential second wave of scams targeting them.

double quotation mark“The reported $6.3 billion Binance hack is alarming, but cryptocurrency holders should also be on high alert for a potential second wave of scams. Criminals could exploit the panic surrounding the incident to trick people into handing over their savings. “Scammers may pose as Binance representatives, sending convincing emails or text messages warning that accounts are at risk or offering to help recover stolen funds. Some could even claim to be from Binance’s security team, urging users to transfer their cryptocurrency to a supposedly ‘safe’ wallet. In reality, following these instructions could mean handing your money directly to criminals.

Binance’s breach may show the “industrialisation of state-sponsored crime” is underwya, argues Keystone Law’s fraud & financial crime partner Syed Rahman:

double quotation mark“The more important number in this hack may not be $6.3 billion. It may well be 20 minutes. The attacks had the advantage of preparation and coordination. Everyone responding had to establish what happened in real time. The challenge for the industry is where collaborative efforts in recovering those losses can ever match the speed of a pre-planned attack without sacrificing safeguards that make financial intervention legitimate. “In essence, the real concern is not that the blockchain failed. It is that systems trusted to control billions of dollars may have been compromised. The weakest point in institutional crypto custody may no longer be the technology holding the assets, but the people and infrastructure authorised to move them. “We may be witnessing the industrialisation of state-sponsored crime. If North Korean involvement is confirmed, this is not simply a criminal group exploiting a weakness within an exchange. It is a state-linked operation capable of extracting significant sums from global financial infrastructure in minutes.That demands a very different response from governments.”

Pre-tax profits were up just 1.9% for the July to September period, hitting £2.2bn.

That’s despite an 8.9% rise in net interest income to £3.6bn, having been offset by an 81% jump in impairment charges - the sums they use for soured loans - from £153m to £277m.

However, NatWest said that impairment charge increase is a comparative issue, reflecting the one-off release of provisions last year, rather than any change in conditions for its borrowers, which has remained stable.

The Binance theft raises ‘serious questions’ for cryptocurrency exchanges, explains Jake Moore, global cybersecurity advisor at security firm ESET

double quotation mark“It is worrying just how quickly billions of dollars can disappear in a modern-day cyber heist, but it is unbelievable that a single laptop has enough privileged access to enable it. If a single device can authorise enormous cryptocurrency transfers, hackers can simply target systems and people until they find a weak link. And there is always one. “While blockchain transactions can be traced, recovering stolen cryptocurrency is far more difficult, especially when attackers move funds across multiple wallets and blockchains extremely quickly using simple and well-known evasion tactics. North Korea has become increasingly sophisticated in using cybercrime to generate enormous sums of money, but this raises serious questions as to whether cryptocurrency exchanges are doing enough to protect customer assets and whether security and regulation is keeping up. “Consumers who choose to keep cryptocurrencies should spread their digital assets across multiple reputable platforms and secure hardware wallets (such as their own USB) to reduce the risk of losing everything in a single attack.”

double quotation mark“The incident underscores the heightened cybersecurity risks associated with hot wallets, a component already exposed by the 2025 hack on Bybit cryptocurrency exchange. It also illustrates the risk concentration inherent in large, centralized intermediaries. Stronger institutional controls can reduce some vulnerabilities, but the scale of assets under custody can amplify the impact of a successful breach. The broader credit and industry implications will depend on the ultimate losses, affected counterparties, asset recovery, and importantly, whether the incident leads to wider disruption or loss of confidence across the digital-asset ecosystem.”

Chainalysis co-founder and CEO Jonathan Levin wrote on X:

double quotation markWe live in unprecedented times. But DPRK are up to their old tricks. We assess @binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack. Industry partners have already frozen ~$3B and we @chainalysis continue to follow all of the funds.

double quotation markEthereum accounts for about $3.79bn. That includes 200,630 ETH and 185 other tokens, among them 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD. Bitcoin outflows total 18,270 BTC, about $1.47bn. Tron outflows total 612.7 million USDT and 46.4 million TRX, about $628m. The XRP Ledger lost 233.46 million XRP, about $296m. Solana outflows total 970,500 SOL, about $96m. Arbitrum, Optimism and Base combine to about $39m, including 74.6 million ARB taken on Arbitrum. Avalanche outflows total about $28m, and Polygon outflows total about $10m.

• Bitcoin: -2.35% over the last 24 hours, to $77,940

• Solana: -2.67%, to $97

Binance ‘working closely’ with law enforcement.

He lists the actions which the digital exchange has taken since discovering the theft:

• Engaged law enforcement and blockchain intelligence partners to trace and recover funds

double quotation markOur team hasn’t stopped. We’re working closely with law enforcement to ensure the matter is handled appropriately - and I’ll share what I can, as soon as I can.

He’s posted a list of points which customers ‘need to know’:

• Estimated total impact: ~$6.3B, with ~$3B frozen on-chain so far, in coordination with our blockchain partners

Binance's Teng: Your money is safe

Richard Teng, the co-chief executive officer of Binance, has pledged that customers money is ‘safe’, despite the hack.

Posting on X a few minutes ago, Teng confirms that it appears the break-in came via an employee’s laptop – but insists it was a ‘more complex’ attack than simply clicking on a rogue link.

double quotation markI want to speak to you directly about what happened. Bottom line - your money is safe, and we’re covering every loss. Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions. To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak.

Teng adds that Binance will share a detailed technical post-mortem once the investigation is complete and every fact is verified - and publish an updated Proof of Reserves once remediation is complete.

The hacker who swiped over $6bn of digital assets from Binance is in the process of switching stablecoins (which can be frozen) into etherium (which can’t), according to media company Decrypt.

double quotation markStablecoin issuers Tether and Circle moved quickly to blacklist the suspected attacker’s addresses in order to freeze a portion of the funds and make them inaccessible. As centralized issuers, they each have the ability to blacklist addresses so their tokens cannot move, and more than $2 billion of those two tokens have been frozen so far by different stablecoin providers. ETH has no issuer, so every dollar converted before a freeze lands is out of their reach.

double quotation markCrypto assets have come under pressure after Binance, the world’s largest crypto exchange, suspended deposits and withdrawals following a suspected hacking incident. Bitcoin is down -0.40% this morning, following a -3.03% slide yesterday.

Elite North Korean hackers blamed for Binance theft

TRM Labs, a blockchain intelligence firm that tracks the industry, has declared that an elite North Korean hacking unit called TraderTraitor was responsible for the security breach at Binance.

• On October 29, 2026, an attacker moved approximately $6.36bn out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the $1.5bn Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.

• TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.

Bitcoin and crypto firms hit by Binance breach

News of Binance’s security breach sent bitcoin falling by more than 3% to a six-week low of $76,368 – although it’s since recovered back to $78,335 (-0.6%).

Shares in crypto exchange Coinbase Global are down 4.8%, while Strategy, the US company which has been a massive buyer of bitcoin, fell 5.75%.

Binance freezes withdrawals after $6.3bn security breach

Digital assets worth more than $6.3bn (£4.7bn) have reportedly been taken from Binance by North Korean hackers, apparently after a laptop belonging to one of its engineers was hacked.

“Rest assured that user funds are completely safe,” a Binance spokesperson said in a statement.

Binance said it had worked with partners to ⁠freeze the affected assets, with about $3bn ⁠located so far. It gave no update on ​the status of the remaining $3.3bn as Binance co-founder Yi He said the company would cover “all hacking losses”.

Introduction: UK house price growth slowest since January 2024

Britain’s housing market is feeling an autumnal chill, as rising mortgage rates hits demand.

UK annual house price growth slowed to 0.5% in October, the slowest pace since January 2024, new data from Nationwide this morning shows. That’s down from 0.8% in the year to September.

The jump in fixed-rate mortgages to almost 6%, on average, appears to have dampened buyers’ enthusiasm, pushing up the cost of repaying a mortgage.

double quotation mark“Market activity and house price growth have slowed in recent months, in part reflecting the uncertain economic backdrop. Geopolitical tensions remain high, with the conflict in the Middle East exerting upward pressure on energy prices, fanning inflation concerns. “This in turn has led to mounting financial market expectations of Bank Rate increases, which have maintained upward pressure on the market interest rates which underpin mortgage pricing.

double quotation markSurveyors report that new buyer enquiries remain weak. Moreover, consumer sentiment dipped noticeably in October, with households becoming less confident about the outlook for the general economy as well as their own financial situation in the year ahead.

The agenda

• 10am GMT: eurozone GDP report for Q3 2026