The FBI says North Korean hackers stole about $6.3 billion from Binance in 20 minutes, the biggest crypto theft on record, after breaking into one engineer's laptop.
The FBI has officially blamed North Korea for the theft of more than $6 billion in cryptocurrency from Binance, one of the world's largest crypto exchanges. The agency says the attack happened on or about October 29, 2026. It is the largest crypto heist on record. Binance says customers will not pay for the loss.
The FBI named the group TraderTraitor, also known as Lazarus Group, Jade Sleet and APT38. It is a hacking team backed by the North Korean government. Blockchain research firms TRM Labs and Chainalysis had already tied the theft to the group. The attackers took roughly $6.36 billion across ten blockchains, which are the public ledgers that record crypto transactions. Most of the money moved in just 20 minutes.
Binance has said the breach began with the laptop of one DevOps engineer, a person who helps run the company's systems. That gave the attackers access to a service container, a kind of software box that runs part of the exchange. From there they submitted withdrawals no one had approved.
The FBI notes this group has a pattern of going after employees, not just code. It points to several past thefts:
The FBI expects the thieves to turn the loot mostly into Ethereum and then try to hide it through decentralized finance platforms and instant swap services. The FBI, the Secret Service and IRS Criminal Investigation are asking exchanges and other crypto firms to block transactions linked to the hackers. The FBI published 628 addresses tied to the theft: 608 Ethereum, 19 Bitcoin and one Solana.
Binance says it has covered about 95% of the affected amount, up from 90% in its last update. The rest is in less-liquid tokens, which are harder to buy quickly. The company plans to restart the first phase of withdrawals on November 1 between 06:00 and 09:00 UTC. It says deposits were not affected and that major coins such as BTC, ETH and USDT are fully backed.
If you keep crypto on an exchange, this shows how much can ride on one employee's computer. The group often starts with a friendly message, such as a recruiter offering a job or a test to run before an interview. Anyone who works in crypto or software should treat unexpected job offers and work requests with suspicion, and never run code from a stranger.
One hacked laptop put billions at risk, so be wary of unexpected job offers and work requests, especially if you work near money or code.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA fake call in Truro, Canada, sent a police tactical team to a woman's home. An RCMP officer now shares plain rules for spotting phone scams.
Read more: Canadian police share simple rules to beat phone scammersKMBC 9 News has launched Scam School, a series on spotting the warning signs of scam texts and calls so you can protect your money and your family.
Read more: A local TV series shows the warning signs of phone and text scams
