AnswersPublished24 sources
Binance’s $6.3 Billion Hack: What’s Known About the Theft, Laundering and Recovery
About $6.3 billion was stolen from Binance on October 29, 2026, and the FBI attributed the theft to North Korea linked TraderTraitor. Elliptic traced the laundering across about 12,000 wallets and 11 blockchains in under four days; researchers also warned that some funds may be reaching Chinese laundering networks.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- About $6.3 billion was stolen from Binance on October 29, 2026, and the FBI attributed the theft to North Korea linked TraderTraitor.
- Elliptic traced the laundering across about 12,000 wallets and 11 blockchains in under four days; researchers also warned that some funds may be reaching Chinese laundering networks.
- Binance resumed withdrawals and said it had covered most of the loss, but that customer protection does not mean the stolen crypto was recovered.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What does the November 4, 2026 reporting reveal about the record $6.3 billion cryptocurrency theft from Binance on October 29, including the. Article summary: The available reporting describes a record cryptocurrency theft attributed to North Korea, followed by rapid laundering and a race to freeze the proceeds; however, the supplied excerpts do not substantiate all the detail. Topic tags: general, news, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts w
The October 29, 2026, Binance theft was valued at roughly $6.3 billion, making it the largest crypto theft reported at the time. The FBI attributed it to North Korea-linked TraderTraitor. In the days that followed, investigators tracked rapid movement across blockchains, reported billions frozen or intercepted, and raised the possibility that some funds were reaching Chinese laundering networks. Those figures describe different things: tracing funds, freezing them, and replacing customer assets are not the same as recovering stolen cryptocurrency. 1
18
22
25
What happened—and who was blamed
TRM Labs estimated that about $6.36 billion left Binance wallets across 10 blockchains, mostly within roughly 20 minutes. Elliptic put the value at about $6.43 billion and tracked funds across 11 blockchains; these are different firms’ estimates, not a single reconciled total. 18
24
25
The FBI attributed the theft to North Korea-linked TraderTraitor. North Korea denied responsibility, with Kim Yo Jong calling the U.S. allegations a political provocation. 1
2
50
Reporting on Binance’s account of the breach described a social-engineering route: attackers allegedly used a fake job interview to trick an engineer into downloading malicious software. That detail points to employee access as an important part of the reported attack, rather than a simple theft from an exposed wallet. 48
52
A fast, widely dispersed laundering trail
Elliptic reported that the funds were spread across about 12,000 wallets and more than 40,000 transactions in under four days. Its update described the activity as conventional automation—not evidence that AI was directing the laundering. 23
32
TRM Labs reported that the attackers used methods involving USDT and ETH, including sales to market makers and borrowing ETH against USDT through Aave. The firm also reported holdings of more than 420,000 ETH and 18,270 BTC, with about $2.4 billion in assets beyond issuers’ ability to freeze, according to its analysis. “Beyond issuers’ reach” describes a limit on one kind of intervention; it does not establish that those funds are permanently unrecoverable. 24
What is known about Chinese laundering networks
Elliptic warned that funds already being laundered may have reached Chinese money-laundering networks, which it said North Korea had used in previous cases. Separately, a South Korean report quoted a TRM Labs investigator saying Chinese networks were conducting complex trading activity connected to the flows. 25
42
That reporting supports a possible role for Chinese networks in handling some of the proceeds. It does not, on its own, establish that the stolen funds were converted into yuan and deposited in Chinese bank accounts, or confirm a specific commission arrangement for this theft. The same South Korean report referenced an earlier U.S. case involving Chinese nationals accused of converting cryptocurrency stolen by North Korea into cash and moving it to Chinese bank accounts; that historical case is not proof of the same route being used here. 42
Frozen funds, customer coverage and recovery are different measures
Binance reported that about $2.85 billion had been frozen or intercepted, subject to reconciliation and market-price changes. Elliptic also reported $2.85 billion frozen and estimated that about $3.24 billion remained in addresses linked to the theft, mostly in ETH and BTC. Those are dated tracking estimates, not a final accounting of what investigators can recover. 22
32
Binance resumed withdrawals on November 1. Reuters reported that the exchange said it had covered about $6 billion of the stolen cryptocurrency, while customers withdrew $3.64 billion as services returned. NPR also reported that Binance had replaced most of the stolen customer assets with its own funds. Replacing customer assets protects users’ balances; it does not mean the attackers’ crypto has been seized or returned. 33
48
What the reporting does—and doesn’t—say about market risk
TRM’s reported ETH holdings and the described conversions make large-scale selling a potential source of market pressure. But the supplied reporting does not establish that such sales caused a specific price move or provide a reliable forecast of future volatility. 20
24
The clearest picture is therefore a race on two fronts: investigators and crypto firms are tracing and trying to freeze assets, while Binance has acted to cover customer losses. The laundering trail points to possible intermediaries, including Chinese networks, but the evidence presented so far does not confirm every claimed cash-out route or show how much of the stolen crypto will ultimately be recovered. 22
25
33
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Binance’s $6.3 Billion Hack: What’s Known About the Theft, Laundering and Recovery"?
About $6.3 billion was stolen from Binance on October 29, 2026, and the FBI attributed the theft to North Korea linked TraderTraitor.
What are the key points to validate first?
About $6.3 billion was stolen from Binance on October 29, 2026, and the FBI attributed the theft to North Korea linked TraderTraitor. Elliptic traced the laundering across about 12,000 wallets and 11 blockchains in under four days; researchers also warned that some funds may be reaching Chinese laundering networks.
What should I do next in practice?
Binance resumed withdrawals and said it had covered most of the loss, but that customer protection does not mean the stolen crypto was recovered.