AnswersPublished22 sources
What investigators know about the $6.4 billion Binance hack
About $6.3–$6.43 billion was stolen from Binance on October 29, 2026. The FBI attributed the theft to North Korea’s TraderTraitor group; tracking reports show substantial fund movements, but much less confirmed cash out.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- About $6.3–$6.43 billion was stolen from Binance on October 29, 2026. The FBI attributed the theft to North Korea’s TraderTraitor group; tracking reports show substantial fund movements, but much less confirmed cash out.
- Binance described a months long campaign that compromised engineers’ computers and reached wallet infrastructure.
- By November 6, Elliptic linked reporting said about $2.85 billion had been frozen or seized and $3.11 billion remained in theft linked addresses.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What do Chainalysis, Elliptic, the FBI and Binance report about the record October 29 theft of more than $6 billion from Binance, including. Article summary: The reports describe a record theft of roughly $6.3–$6.43 billion from Binance on October 29, 2026, which the FBI attributes to North Korea; they also distinguish movement of stolen crypto from successful cash-out. [1][4. Topic tags: general, government, general web, user generated, news. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermark
The October 29, 2026 theft from Binance was estimated at roughly $6.3 billion by Binance and about $6.43 billion by Elliptic. The FBI attributed it to North Korea’s TraderTraitor group. Subsequent tracking has documented extensive movement of the stolen crypto, but movement between wallets or blockchains does not, by itself, show that funds were successfully cashed out. 1
4
8
19
How attackers reached Binance’s wallet infrastructure
Binance described a months-long operation that compromised three engineers’ computers. Its account, reported by SecurityWeek, says one compromise began with a fake job interview; reporting on Binance’s incident findings also describes malicious software and the use of an internal AI tool in the intrusion. The attackers ultimately reached infrastructure involved in signing wallet transactions. 4
15
That distinction matters: the internal AI tool was described as part of the intrusion, while Elliptic’s reporting characterized the subsequent laundering as automated. The available reporting supports automation in the movement of funds; it does not establish that AI agents made laundering decisions. 15
17
The FBI’s attribution and the scale of the theft
The FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance and named the activity TraderTraitor. 1 Elliptic estimated the loss at $6.43 billion—more than four times the $1.46 billion stolen in the 2025 Bybit hack, according to its comparison.
8
The estimates differ because the organizations’ reports use their own accounting and tracking. It is clearest to describe the theft as roughly $6.3–$6.43 billion, rather than treating one estimate as an exact, universally agreed total. 4
8
How the stolen funds moved
Blockchain tracking reports describe activity across multiple networks. A report summarizing Chainalysis findings said more than $500 million passed through Tron staging wallets and that funds were routed onward across chains, including to Ethereum and Bitcoin. 24
Elliptic reported that about 233 million XRP was moved into six new addresses on November 2, where it remained until November 5. By an update covering November 6, about 42 million XRP—worth roughly $50 million—had been swapped, mostly into Bitcoin through THORChain. 7
3
These examples show why “moved,” “laundered” and “cashed out” should not be used interchangeably. A transfer to another address, a cross-chain swap or a conversion into a different cryptocurrency can make funds harder to track, but does not necessarily mean the value has been turned into spendable fiat currency.
What is known about freezes and cash-out
As of a November 6 update, Elliptic-linked reporting said about $2.85 billion had been frozen or seized and approximately $3.11 billion remained in addresses linked to the theft, mostly in Ether and Bitcoin. Those figures are a dated snapshot, and they do not add up to a full accounting of the estimated theft. 17
A separate report attributed to Chainalysis said only hundreds of thousands of dollars had reached Chinese laundering networks, including over-the-counter platforms, even as nearly $1 billion in stolen assets had begun moving into laundering channels. It also described roughly $2.42 billion in Bitcoin and Ether as showing limited onward movement. The figures refer to different stages and measures; funds entering a laundering route are not necessarily funds already cashed out. 19
Public blocking requests and Binance withdrawals
Elliptic said the FBI published attacker addresses and urged THORChain operators and other services to block transactions linked to them. SecurityWeek reported that the FBI flagged more than 600 related addresses. 7
16
Binance resumed withdrawals on November 1. The exchange reported that, between 06:00 and 15:30 UTC, it processed about $4.649 billion in withdrawals and $1.01 billion in deposits, for a net outflow of approximately $3.64 billion. That figure describes customer flows after withdrawals reopened—not the amount stolen in the attack. 5
55
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "What investigators know about the $6.4 billion Binance hack"?
About $6.3–$6.43 billion was stolen from Binance on October 29, 2026. The FBI attributed the theft to North Korea’s TraderTraitor group; tracking reports show substantial fund movements, but much less confirmed cash out.
What are the key points to validate first?
About $6.3–$6.43 billion was stolen from Binance on October 29, 2026. The FBI attributed the theft to North Korea’s TraderTraitor group; tracking reports show substantial fund movements, but much less confirmed cash out. Binance described a months long campaign that compromised engineers’ computers and reached wallet infrastructure.
What should I do next in practice?
By November 6, Elliptic linked reporting said about $2.85 billion had been frozen or seized and $3.11 billion remained in theft linked addresses.
Sources
fbi.govNorth Korea Responsible for $6 Billion+ Binance Attack — FBI
bleepingcomputer.comBinance links $6.3 billion crypto theft to compromised DevOps laptop
elliptic.coThe largest theft in history: North Korea behind the $6.4 billion Binance hack
en.cryptonomist.chBinance stolen funds laundering tracked to Chinese networks