Binance’s $6.3B Hack: Investigators Trace Breach to North Korea

Binance is dealing with what investigators describe as the largest crypto hack on record: an exploit valued at about $6.3 billion and linked to North Korea. Reports say attackers compromised infrastructure used to approve transactions from hot wallets—online wallets used to move funds—and erased evidence while bypassing security checks, according to CEO Richard Teng.

One reported portion of the stolen funds is 18,270 bitcoin, worth about $1.4 billion. That amount is close to SpaceX’s disclosed bitcoin holdings and larger than Tesla’s, according to CoinDesk’s comparison. Binance planned to restart withdrawals on Sunday and publish proof of reserves on Monday, though those were targets reported on October 30, not confirmation that either step occurred.

What do we know about the Binance breach?

The available reports describe a compromise of hot-wallet signing infrastructure, the systems that authorize transactions. That makes this more than a case of a user losing access to an account: the attackers allegedly got around controls designed to prevent unauthorized transfers from exchange wallets. The reports do not provide a complete technical account of how the signing systems were breached.

Investigators have linked the attack to North Korea. That attribution is significant, but it remains an investigators’ assessment; the reports do not describe a public admission by the attackers or provide evidence that would independently establish responsibility.

Where did the stolen bitcoin go, and what happens next?

The 18,270 BTC figure gives a sense of the scale, but it does not account for the entire $6.3 billion exploit. The reports also do not spell out a complete destination-by-destination breakdown of the funds. Binance’s stated next steps were to resume withdrawals and release proof-of-reserves information, which is intended to show assets held against customer balances. Neither step, by itself, proves how the breach happened or guarantees that every asset is immediately accessible.

For customers, the concrete thing to watch is whether Binance confirms withdrawals have resumed and publishes the promised reserve data. This incident also lands amid a run of North Korea-linked crypto theft reports, including the $1.5 billion Bybit case and a reported $387 million Bitget hack. The Binance figure is dramatically larger, but the practical question for exchange users is the same: how well are transaction approvals protected, and how clearly can the platform account for customer assets after a breach? You can compare the cases in our coverage of the Bybit fund-tracing effort and the North Korea-linked Bitget theft.