Binance told BleepingComputer on 30 October 2026 that about $6.3 billion in cryptocurrency was stolen after attackers used a compromised DevOps engineer's laptop to access a service container and submit unauthorised withdrawal transactions, and that it has found no evidence of a wallet private-key leak.

Binance Co-CEO Richard Teng said the attack "involved a more complex attack process" and that the company had "uncovered additional points of breach" while still gathering facts; Binance said it will cover all losses from its SAFU fund and company funds and that user funds are safe. (source: BleepingComputer quoting Binance)

Binance's own 30 October Security Incident Update announcement URL returned HTTP 202 to the CyberStack desk this pass (unreadable; no retry), so company wording here rests on BleepingComputer's quotation of Binance's statement.

The FBI said on 31 October 2026 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October 2026, referring to the activity as TraderTraitor, and urged virtual-asset service providers to block transactions linked to listed addresses. (source: FBI Cyber Alert) iTnews, carrying a Thomson Reuters report dated 4 November 2026, said Binance's later report described a multi-stage campaign that began in June when a wallet-developer employee downloaded a tampered tool, continued in September when a second engineer downloaded a malicious code repository after a fake job interview, and culminated on 29 October when attackers used compromised machines and an internal AI tool before draining hot wallets; Binance said it froze about US$2.85 billion of affected assets and is repaying customers. (source: iTnews / Thomson Reuters quoting Binance)

North Korea has rejected the FBI's claim, according to that Reuters report. TRM Labs and Chainalysis attribution of TraderTraitor/Lazarus, and freeze totals those firms publish, are analyst findings reported by BleepingComputer and are not Binance or FBI confirmations of those secondary figures. (source: BleepingComputer quoting TRM/Chainalysis)