# Binance Loses $6.3 Billion in Half an Hour After Hackers Linked to North Korea Compromise an Engineer's Laptop

Tether and Circle froze billions in stolen stablecoins within hours, and legal experts question whether smaller victims would get the same protection.

- Published: 2026-10-31T05:13:16.885Z
- Canonical: https://polylog.news/2026-10-31/binance-loses-6-3-billion-in-half-an-hour-after-hackers-link
- Publisher: Polylog (Global desk)
- Section: crypto
- Sources: [Financial Times](https://www.ft.com/content/e84eceda-040b-4e5f-b906-09768085933a?syn-25a6b1a6=1), [The Japan Times](https://www.japantimes.co.jp/business/2026/10/31/binance-hack-disappearing-money/), [CoinDesk](https://www.coindesk.com/business/2026/10/30/experts-divided-over-binance-hack-asset-freezes-warn-recovery-is-another-matter), [MercoPress](https://en.mercopress.com/2026/10/30/hackers-steal-us-6.3-billion-in-crypto-from-binance-in-the-sector-s-biggest-ever-heist?utm_source=feed&utm_medium=rss&utm_content=main&utm_campaign=rss)

Attackers took about $6.3 billion from Binance in roughly [30 minutes](https://www.ft.com/content/e84eceda-040b-4e5f-b906-09768085933a?syn-25a6b1a6=1), according to the Financial Times. Binance is the world's largest crypto exchange, and the [FT reported](https://www.ft.com/content/c7f5e395-c3a9-430e-b757-5014527b4d49?syn-25a6b1a6=1) that the exchange said an engineer's laptop had been compromised. [MercoPress reported](https://en.mercopress.com/2026/10/30/hackers-steal-us-6.3-billion-in-crypto-from-binance-in-the-sector-s-biggest-ever-heist?utm_source=feed&utm_medium=rss&utm_content=main&utm_campaign=rss) that the US Secret Service is investigating with other agencies. Blockchain analytics firms, including [TRM Labs](https://www.cnbc.com/2026/10/30/binance-hack-bitcoin-price.html), link the attack to a hacking group tied to North Korea. Binance suspended withdrawals after what it called a "complex attack."

The Japanese wire service [Jiji Press](https://www.jiji.com/jc/article?k=2026103100261&g=int) described the attack as complex and difficult to trace. [The Japan Times](https://www.japantimes.co.jp/business/2026/10/31/binance-hack-disappearing-money/) argued that the theft exposes a risk that exchanges cannot fully solve, because stolen digital assets can move beyond recovery however strong an exchange's defenses are. The previous largest theft, North Korea's [$1.5 billion theft from Bybit](https://www.yahoo.com/news/north-korean-hackers-pull-off-161150442.html) in February 2025, was about a quarter of this size.

Recovery depends on which assets were taken. [CoinDesk reported](https://www.coindesk.com/business/2026/10/30/experts-divided-over-binance-hack-asset-freezes-warn-recovery-is-another-matter) that Tether, Circle and other issuers moved within hours to block billions of dollars in stolen tokens. Legal experts it quoted question whether issuers would act as quickly for smaller victims, and they warned that freezing assets is different from returning them. The [US State Department](https://www.thehindu.com/sci-tech/technology/north-korean-hackers-linked-to-crypto-thefts-among-worlds-best-experts-say/article71648161.ece) called North Korean cybercrime "a global problem."

Bitcoin itself fell less than many traders expected. One strategist [told CNBC](https://www.cnbc.com/2026/10/30/binance-hack-bitcoin-price.html) that investors distinguished between a breach at a centralized exchange and the security of the Bitcoin network.

## What this means

The hack shows two things at once. Self-custodied bitcoin does not depend on an exchange's security, while dollar stablecoins can be frozen by their issuers on request, which makes them a tool of enforcement as well as of payment. Exchanges with concentrated hot-wallet balances are exposed through withdrawal runs and higher insurance costs. Stablecoin issuers gain standing with regulators because they showed they can freeze funds. North Korea gains hard currency that sanctions cannot easily reach. The Bybit theft in 2025 was followed by tighter custody rules in several jurisdictions but no slowdown in North Korean thefts. The desk's read is that regulators in the United States, Japan and the European Union will use this theft within months to require exchange-level custody standards and faster freeze cooperation, and that more trading volume will move to venues that can show segregated cold storage. That read is wrong if Binance restores full withdrawals quickly and covers losses from its own reserves without outside intervention, because that would reduce the political case for new rules.

## What to watch

- The date Binance fully reopens withdrawals and whether it covers losses from its own reserves. A delay would test whether customers keep their assets on the exchange.
- Whether stolen funds that were not stablecoins move through mixers or cross-chain bridges. That movement would show how much of the $6.3 billion remains out of reach.
- Statements from the Japanese, Korean and US foreign ministers on joint action against North Korean cybercrime. Coordinated sanctions on laundering networks would raise the cost of cashing out.