Photo via CBS News

$6.3 billion Binance hack was likely work of North Korea, intel firms say

Read the original at CBS News ↗
Cite

$6.3 billion Binance hack was likely work of North Korea, intel firms say. (2026, October 30). CBS News. https://www.cbsnews.com/news/binance-hack-north-korea/

Dated from the outlet's own feed. Check the original for its byline.

CBS News · collected 2026-10-30

Quick Summary

Blockchain intelligence firms TRM and Chainalysis have attributed the recent $6.3 billion hack of Binance, the world's largest cryptocurrency exchange, to North Korea’s elite hacking unit TraderTraitor. Following the incident, Binance suspended withdrawals while working with partners to freeze around $3 billion in stolen assets and announced it would cover all losses. The attack occurred over a short period, primarily within 20 minutes, marking the largest crypto theft on record. Authorities are investigating, as North Korea has increasingly turned to such activities for financial gain amid economic hardships and sanctions.
Written by AI on 2026-10-30, from this article's own text only (the story summary below draws on all the coverage).

AI analysis

Story summary

Binance, the world's largest cryptocurrency exchange, reported that hackers stole up to $6.3 billion in a massive hack on October 29, 2026, which could be the largest crypto theft ever recorded. The company has frozen over $2.54 billion worth of funds as a precaution while investigating the incident. Paolo Ardoino, CEO of Tether, and Jeremy Allaire, CEO of Circle, both confirmed that their companies had frozen over $1.567 billion in digital currency related to the potential hack. Binance stated user funds are safe but did not explicitly confirm whether any money was lost; however, it is investigating multiple "points of breach." The North Korean-linked Lazarus group has been suspected by some blockchain intelligence firms as being behind the attack.

Written for “Binance Hack By North Korean Hackers” on 2026-10-30, grounded in this article and the 18 other(s) covering the same event.
Why this leaning score
This article does not take a side on a contested political question, so it has no leaning score. That is an answer rather than a gap: a match report or a rescue can be warmly or critically written without being left or right, and scoring it anyway is how approval of a subject gets recorded as a political position.
No political leaning scored for article 117110 · logged 2026-10-30

Story

📰 Binance Hack By North Korean Hackers
Technology · 19 article(s) covering the same event. Compare every outlet's account →

Compared with similar articles

This article reads unscored and hedges 4% of its claims. Each row says how that neighbour differs.
Toronto Star
Hedges 0 of 24 claims Outlet record 64/100
BBC News
Hedges 0 of 5 claims Outlet record 69/100
CBC News
Hedges 2 of 27 claims Outlet record 60/100
NPR
Hedges 3 of 24 claims Outlet record 60/100
Dawn
Hedges 7 of 32 claims Outlet record 72/100
New York Post
Hedges 1 of 13 claims Outlet record 66/100
The Sydney Morning Herald
Hedges 7 of 28 claims Outlet record 61/100
BBC News
Hedges 7 of 39 claims Outlet record 69/100
Al Jazeera
Hedges 0 of 7 claims Outlet record 60/100
ABC News (AU)
Hedges 4 of 26 claims Outlet record 68/100
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
26
sentences that state something as happening or true
Uncertain
4%
1 of 26 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
66/100
CBS News's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
19
Technology
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-10-30 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

CBS News · 4181 article(s) · 6 correction(s) detected
Running correction rate · 6 correction(s)

Who wrote this

No reporter is named on this article.

Topics

Binance North Korea North Korea's TRM TraderTraitor

Subjects

Binance ORG · 10× North Korea GPE · 3× North Korea's GPE · 3× TRM ORG · 3× TraderTraitor ORG · 3× Bybit ORG · 2× DPRK GPE · 2× FBI ORG · 1× U.S.-based GPE · 1× unit ORG · 1×

Narrative

"This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said, referring to cryptocurrency wallets that hold users' "private keys," or unique authorizations, digitally and which are connected to the internet.
framing: assertive · carried by 1 article(s) · first seen 2026-10-30
🔮 The cryptocurrency exchange said Friday that deposits were unaffected, while withdrawals were suspended and are expected to resume in the next day or two.

Claims (26 extracted, 1 hedged)

A U.S.-based blockchain intelligence firm says a unit was likely behind the hack that impacted more than $6 billion on Binance, the world's biggest cryptocurrency exchange. asserted
that → say → Binance
Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets. asserted
it → say → assets
The cryptocurrency exchange said Friday that deposits were unaffected, while withdrawals were suspended and are expected to resume in the next day or two. asserted
withdrawals → say → day
It said it will cover all losses. asserted
it → say → losses
The company said on social media Friday that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional "points of breach." uncertain
investigation → say → breach
TRM, in a post on its website Thursday, attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit. asserted
it → attribute → unit
"We make this judgment with high confidence," the firm said. asserted
firm → make → confidence
"An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," TRM said. asserted
TRM → move → minutes
That would make the hack the largest cryptocurrency theft on record, it said. asserted
it → make → record
In February last year, another cryptocurrency exchange, Bybit, suffered a $1.5 billion hit when it was hacked. asserted
it → suffer → hit
The FBI said North Korea and TraderTraitor were responsible for the hack. asserted
Korea → say → hack
"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack," TRM said. asserted
TRM → match → hack
Blockchain analysis company Chainalysis also believed the Binance hack was "likely done by DPRK group TraderTraitor," its co-founder and CEO Jonathan Levin wrote on social media. asserted
Levin → believe → media
DPRK stands for the Democratic People's Republic of Korea, North Korea's official name. asserted
DPRK → stand → Korea
Binance said on social media that its "teams are working around the clock to resolve this issue safely and thoroughly. asserted
teams → say → issue
We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice." asserted
We → work → justice
Experts say North Korea has turned to crypto hacking and other illicit cyber activities as a source of badly needed foreign currency to support its troubled economy and fund its nuclear program in the wake of tough U.N. sanctions and other difficulties. asserted
Korea → say → sanctions
In December 2022, South Korea's spy agency said North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in cryptocurrency and other virtual assets in the past five years, more than half of it in 2022 alone. asserted
hackers → say → 2022
It said North Korea's capacity to steal digital assets was considered among the best in the world. asserted
capacity → say → world
Changpeng Zhao, also known as CZ, founded Binance in 2017. asserted
Zhao → know → 2017
In 2023, he pleaded guilty to a felony linked to failing to prevent money laundering on the platform, and stepped down as the company's CEO. asserted
he → plead → CEO
President Trump .Zhao posted Thursday on social media that "User funds are safe!" but added that the theft "does look like a hack on Binance." asserted
theft → post → Binance
He added that while he doesn't manage Binance anymore, "As a shareholder, I expect all user funds will be fully covered. asserted
funds → add → shareholder
" The event, meanwhile, also raises questions about why stronger approval controls were not in place, said Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab. asserted
Gan → raise → NyxLab
"This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said, referring to cryptocurrency wallets that hold users' "private keys," or unique authorizations, digitally and which are connected to the internet. asserted
which → look → internet
Binance said on social media it had "found no evidence of any wallet private key leak" and that the company would release more technical details when its probe is complete. asserted
probe → say → details
💬Give feedback
🕘History 🎫Support