The $6.3 billion Binance hack explained: the FBI blames North Korea, and what Australian crypto users should check

By The Rundowns News Desk · Published 1 November 2026 · Updated 1 November 2026

Binance, the world's largest cryptocurrency exchange, lost about US$6.3 billion (around A$8.9 billion) in a hack on Thursday 29 October US time, which was Friday morning in Melbourne. Analysts say it's the biggest crypto theft on record, and possibly the biggest theft of any kind. Binance says customers won't wear the loss. Update, 1:15pm AEDT Sunday 1 November: the FBI has now officially blamed North Korea. Here's what's confirmed, what isn't, and what to check if you hold crypto in Australia.

What happened

Blockchain analytics firm Chainalysis says funds began leaving Binance's "hot wallets" across multiple blockchains at about 4:20pm US Eastern time on 29 October. That's about 7:20am AEDT on Friday 30 October. Hot wallets are internet-connected wallets used for everyday trading and withdrawals. The ABC reports 30 to 40 different tokens were affected, including bitcoin, ether and the stablecoins USDT and USDC, according to crypto watchers.

In its own security update, Binance put the estimated impact at about US$6.3 billion. It said its first findings pointed to a compromised DevOps engineer's laptop, which let an attacker reach a service container and submit unauthorised withdrawals, and that it had found "no evidence of any wallet private key leak". Binance has since said it found further breach points, and that the attack "was not carried out by one person" (reported by Elliptic and CoinDesk).

The exact figure varies a little by source. Binance, the ABC, The Guardian and the BBC all use about US$6.3 billion. Chainalysis estimates about US$6.4 billion, and Elliptic US$6.43 billion. Prices of the stolen tokens move, so expect the number to keep shifting.

How big is it?

The previous record was the roughly US$1.5 billion stolen from the Bybit exchange in February 2025, which the FBI attributed to North Korea. This theft is more than four times larger. Elliptic's chief scientist Tom Robinson told The Guardian it is "almost certainly the single largest known theft of any kind", larger than the US$1 billion Saddam Hussein took from Iraq's central bank in 2003.

Who did it? The FBI now says North Korea

On Saturday 31 October US time (Sunday morning in Melbourne), the FBI issued a cyber alert saying North Korea was responsible for stealing "more than $6 billion USD in virtual assets" from Binance "on or about October 29, 2026". It named the operation TraderTraitor, the same group the FBI blamed for the Bybit theft (AP, ABC, The Korea Herald).

• Where the money is going: the FBI says the hackers have been converting the stolen assets mainly into ether (Ethereum), and it expects them to launder the funds further through decentralised finance (DeFi) and "instant swap" services.
• What it's asking for: the FBI, the US Secret Service and the IRS criminal investigation unit have asked exchanges, node operators, DeFi services and blockchain analytics firms to block transactions linked to the hackers' addresses (CoinDesk, The Korea Herald). CoinDesk counted more than 600 Ethereum addresses, just under 20 bitcoin addresses and one Solana address in the notice.
• What happens now: TRM Labs' Ari Redbord told the ABC he expects the hackers to split the funds and push them through smaller exchanges over months, but that investigators can trace the money in real time to disrupt it and seize some back.

Before the FBI statement, three blockchain analytics firms, Chainalysis, Elliptic and TRM Labs (as reported by the BBC), link it to TraderTraitor, a North Korean state-linked hacking group often grouped with the Lazarus Group.

• The evidence they cite: some stolen Binance funds have been mixed on-chain with funds from last month's Bitget exploit, which was already linked to North Korea. The methods, including long preparation, targeting staff and using the exchange's own systems to sign transactions, resemble the Bybit theft.
• The caveats, from Elliptic: the overlap with Bitget funds is still small, and laundering networks can serve more than one client. The attacker was also slower than usual to convert stablecoins, which let billions be frozen. Those caveats were written before the FBI's attribution, which came within two days of the theft.

North Korea has always denied carrying out crypto thefts.

How much has been frozen or replaced

Stablecoin issuers can freeze tokens, and that has limited the damage. Binance said about US$3 billion had been frozen on-chain. Elliptic says it has verified US$2.85 billion of frozen or seized funds, about 44% of the theft and almost all of it USDT and USDC. Chainalysis put the figure at about US$2.8 billion. Analysts say the attacker is swapping the rest into assets that can't be frozen, such as ether.

Separately, Binance says it set aside more than US$6.34 billion of its own money, including US$5 billion held in the affected tokens. On Saturday 31 October it said it had replaced 90% of the stolen assets, up from about 80% a day earlier. It said customer balances in ten major assets, including BTC, ETH, USDT, BNB, SOL, USDC and XRP, were fully backed. It's still buying the remaining, less liquid tokens (CoinDesk, Cointelegraph). The money comes from its corporate treasury, part of its futures insurance fund and its Secure Asset Fund for Users (SAFU). Binance has published a new reserves snapshot, but said the full cryptographic proof would take 40 to 50 hours to generate. Security firm CertiK told Cointelegraph it needed more information to verify the replacement figure.

Why it matters in Australia

Binance operates locally through Investbybit Pty Ltd, which is registered with AUSTRAC, the financial crimes regulator, as a digital currency exchange provider. In August 2025, AUSTRAC ordered Binance Australia to appoint an external auditor over concerns with its anti-money laundering controls. We found no statement from AUSTRAC or ASIC about the hack itself as of Sunday morning (AEDT). Binance's announcement notes that its products and services may not be available in every region.

Australian experts also flagged a wider worry. RMIT's Professor Chris Berg told the ABC the hack "may well be connected" to a recent run of incidents and software vulnerability discoveries driven by frontier AI models. He said the open question is whether it was only possible because of advances in AI. That's his view, and it isn't established.

If you hold crypto: what to check

1. Use only official channels. Get updates from Binance's own app and website announcements, not from links in emails, texts or social media posts. Big hacks are routinely followed by scams pretending to offer "refunds" or "verification". This is general advice, not a report of a specific scam.
2. Never share seed phrases or 2FA codes. No real exchange support agent will ask for them.
3. Check withdrawal status before you act. Binance suspended withdrawals after the hack. Update 6:10pm AEDT 1 Nov: phase one of the reopening has begun. Reuters reports Binance posted on its status page shortly after 06:00 UTC (just after 5pm AEDT) that withdrawals had begun, starting with bitcoin, and Crypto Briefing also reports phase one went live. Binance says the listed networks open progressively, so check the withdrawal page or its network status page for your specific asset and network. The first window runs from 06:00 to 09:00 UTC on Sunday 1 November, which is 5pm to 8pm AEDT tonight (originally reported by Reuters and TokenPost). The first group covers BTC, ETH, BNB, TRX, SOL, XRP, ZEC, DOGE, TON, POL, AVAX, ARB, BASE, OP and SUI. Other assets and networks follow after security checks. Binance warns early withdrawals may be delayed or fail because of heavy traffic, so retry rather than panic. Deposits were not affected. Binance also told Reuters it has now covered about 95% of the stolen tokens, with the last 5% in less liquid assets that take longer to buy back.
4. Think about where your coins sit. Coins on an exchange are an IOU from that exchange. Some holders move long-term holdings to a wallet they control, which brings its own security risks.

What's next

The things to watch are whether the phased withdrawal reopening (which began just after 5pm AEDT on 1 Nov) goes smoothly and when the remaining assets follow, Binance finishing the last 5% of replacements, the full proof of reserves, how much of the laundered ether gets blocked or seized, whether other governments (including Australia) back the FBI's attribution, and Binance's promised technical post-mortem. We'll update this explainer as they land.

General information only, not financial advice. US dollar figures are as reported by the linked sources; the A$8.9 billion conversion is the ABC's. Attribution to North Korea comes from the FBI's 31 October cyber alert and earlier private analytics assessments.