On October 29, 2026, attackers emptied Binance hot wallets. Blockchain firms put the haul near $6.4 billion, across ten or eleven chains, most of it gone in about twenty minutes. The FBI says North Korea did it. Binance says customers will not pay the bill. People still ask the same question: is crypto safe?
How it happened
This was not one bad click. Binance’s November 3 report calls it a months-long campaign. In June a wallet engineer downloaded a tampered installer while searching for an AI coding tool. Security swapped that machine, but the attackers already knew who touched the wallets. In September a different engineer was pitched on a real job site. Two interviews followed, including one with a supposed CEO. The coding assignment was malware. It hid inside a developer tool and slipped past security software. On October 20 that laptop, plus an internal AI tool, reached other engineers. On October 29 stolen credentials signed the withdrawals. Reuters reported that 233 million XRP left five hot wallets in four minutes, then bitcoin, ether, and stablecoins.
Who could be responsible
On October 31 the FBI blamed TraderTraitor, the North Korean unit also tied to the roughly $1.5 billion Bybit hack in February 2025. TRM Labs, Chainalysis, and Elliptic agreed with high confidence. North Korea denies it. Kim Yo Jong called the charge absurd rhetoric. Stolen coins moved toward ether and split across thousands of wallets. Elliptic counted about 12,000 wallets and more than 40,000 transactions in four days, about one new wallet every 25 seconds. About $2.85 billion was frozen, much of it stablecoins issuers can lock. More than $3 billion was still in linked addresses in early November.
Could it happen again?
Yes. The same group already broke its own record. Binance says it stopped 57 suspected North Korea-linked attempts in 2026 before this one landed. The weak spot was not the math. It was a person, a fake job, and a poisoned download. Any big hot wallet carries that risk.
Is crypto safe?
The coins did what they are built to do. A valid signature moved them. That is not safe custody. Binance says the hit was its own hot wallets, not each customer login, and that it will refill balances from its treasury and emergency fund. By November 3, co-CEO Richard Teng said about 98 percent of affected tokens were back and withdrawals had broadly resumed. Customers still pulled billions when the door opened. Reuters put net outflows near $4.7 billion, about 3 percent of platform assets. Prices dipped a few percent and did not collapse. The ledger survived. Leaving a pile on an exchange did not.
Five ways this helps or hurts trust
- Hurts. A giant exchange is not a vault. Size did not stop a laptop.
- Helps. The public ledger worked. The theft showed up in minutes, and issuers froze billions in stablecoins.
- Hurts. Easy money is not free. Officials say thefts like this help North Korea raise cash outside sanctions, and 2026 was already a record year.
- Helps. Firms that cover the loss and publish the facts look like adults after a fire.
- Hurts. Casual holders then face a wave of fake support chats.
Five ways to protect yourself
- Leave the hot wallet. Do not park long-term savings on an exchange. Move coins you will not trade to a wallet you control, and write the seed phrase on paper, offline.
- Doubt the download. Treat job tests, browser add-ons, and software ads as hostile until you confirm the sender on a site you typed.
- Lock the login. Use an app or a hardware key, not text messages, and never approve a login you did not start.
- Ignore the rescue note. No real exchange sends a verify link after a hack. Type the address yourself.
- Expect a freeze. Use an exchange that publishes reserves and says how it covers a breach. Keep emergency cash outside crypto.
Crypto is a public list plus private keys. The list worked. The stolen keys worked too. That can happen again. Make your keys harder to reach than a fake job offer.
New to investing? Start with our Start Here page and the lesson How to Start Investing in 2026.
Get the free Sunday Note
One short, plain-English market note every Sunday. Free.
Sources checked November 4, 2026
- FBI cyber alert, October 31, 2026: North Korea / TraderTraitor responsible for more than $6 billion taken from Binance on or about October 29.
- Binance initial report, November 3, 2026, via Reuters, The Guardian, BBC, CNBC, and The Verge: fake job interviews, malware, and an internal AI tool.
- Elliptic, TRM Labs, and Chainalysis on totals, laundering pace, and TraderTraitor. North Korea’s denial via KCNA, reported by Reuters.
- Reuters, November 2: net outflows near $4.7 billion after withdrawals reopened. BBC: about $3.64 billion net on November 1.
Educational only. Not investment, tax, or security advice.