Claims that North Korean state-linked hackers stole approximately $6.36 billion from Binance, the world’s largest cryptocurrency exchange by trading volume, circulated widely across technology forums and social platforms on Thursday, October 30, 2026. If the figure is accurate, the incident would be the single largest digital asset theft ever recorded, dwarfing every previously documented breach by a factor of four or more.
As of this writing, the headline figure has not been confirmed by Binance in a public statement specifying that amount, and no national law enforcement or intelligence agency has issued a formal attribution naming the Democratic People’s Republic of Korea. NarwhalTV is treating the $6.36 billion number as an unverified claim pending independent confirmation from the exchange, blockchain analytics firms, or government sources.
What is being claimed
The core assertion spreading online is that attackers compromised exchange-controlled wallets and moved billions of dollars in customer and corporate assets off-platform, and that the operation was carried out by hackers working on behalf of North Korea. The claim follows earlier reporting on a Binance hot wallet being drained and withdrawals being paused, and appears to be an escalation of loss estimates tied to that event rather than a separate, unrelated breach.
Two things are worth separating: the existence of a serious security incident, and the specific dollar figure and attribution attached to it. The first has been the subject of visible platform disruption. The second remains unproven.
Loss estimates in the first hours and days after a major exchange breach are frequently revised, sometimes sharply in both directions. Early numbers often conflate total wallet balances with amounts actually moved, count internal transfers to new custody addresses as outflows, or price illiquid tokens at pre-incident market rates that collapse the moment stolen supply hits the market.
Why suspicion falls on Pyongyang
Even absent confirmation, North Korea is the first suspect in any nine- or ten-figure crypto theft, and for documented reasons. Clusters tracked by researchers under names including Lazarus Group and TraderTraitor have been tied by the U.S. Federal Bureau of Investigation and Treasury Department to a long series of exchange and bridge compromises.
A pattern of escalating thefts
- Ronin Bridge (March 2022) — roughly $625 million drained from the network behind the game Axie Infinity; attributed by the U.S. Treasury to Lazarus Group.
- DMM Bitcoin (May 2024) — about $305 million stolen from the Japanese exchange, which later wound down operations. The FBI and Japanese police attributed the attack to TraderTraitor.
- Bybit (February 2025) — approximately $1.5 billion in Ethereum-based assets taken in what was, until now, the largest crypto theft on record. The FBI publicly attributed it to North Korean actors.
Analytics firms including Chainalysis and Elliptic have estimated that North Korea-linked operations stole well over $1 billion in 2024 and more than $2 billion in 2025. United Nations sanctions monitors have repeatedly assessed that stolen cryptocurrency funds a substantial share of the country’s weapons programs, making exchanges a strategic rather than merely opportunistic target.
The known playbook
Recent North Korean operations have leaned less on exotic software exploits and more on people. Documented techniques include elaborate fake recruitment campaigns that deliver malware to engineers through bogus coding tests, compromise of third-party developer tooling and signing infrastructure, and the placement of fraudulent remote IT contractors inside legitimate companies using stolen or synthetic identities.
The Bybit case illustrated the pattern: attackers reportedly manipulated what operators believed was a routine transfer from cold storage, turning a legitimate internal process into the vector of theft. Once funds move, laundering follows a familiar sequence — rapid conversion of tokens into native assets like Ether or Bitcoin, dispersal across thousands of intermediary addresses, use of mixers and cross-chain bridges, and eventual cash-out through over-the-counter brokers in permissive jurisdictions.
What this would mean for users
Binance has historically maintained an emergency reserve, marketed as the Secure Asset Fund for Users, alongside published proof-of-reserves attestations showing customer assets backed at or above one-to-one. The practical question for account holders is not whether a breach occurred but whether the exchange’s remaining reserves and corporate balance sheet can absorb the loss without imposing haircuts on customers. Bybit covered its 2025 shortfall within days through a combination of reserves, loans and partner liquidity.
Users should expect, and tolerate, temporary withdrawal halts during incident response. Pausing outflows is standard containment practice: it prevents attackers from continuing to exfiltrate funds and stops a panic-driven run while forensics proceed. Prolonged, unexplained pauses are the warning sign, not brief ones.
Unanswered questions
- What exactly was taken, in which assets, and from which wallets?
- Was the entry point a compromised employee device, a supply-chain dependency, or signing infrastructure?
- Have any funds been frozen by stablecoin issuers or recovered through exchange cooperation?
- Will a government agency formally attribute the incident, and on what evidence?
Attribution typically takes weeks. The FBI’s Bybit statement came roughly a week after that theft and included specific wallet addresses, giving the private sector something actionable. Until comparable detail emerges here, the North Korea label rests on pattern recognition rather than published evidence.
The wider security picture
The incident lands in a year marked by large-scale data and identity compromises across sectors, from the exposure of tens of thousands of Department of Homeland Security personnel records to a separate breach affecting U.S. immigration agents. The common thread is that attackers increasingly target the humans and vendors around a system rather than its cryptography.
For crypto specifically, the structural lesson has not changed since 2022: concentrated custody creates concentrated risk. Centralized exchanges remain the most convenient venue for trading and the most valuable single target for a state-backed intelligence service with a revenue mandate.
This is a developing story. NarwhalTV will update as Binance, analytics firms and government agencies publish verified figures.
