Binance Hack Traced to North Korea, $6.3 B Stolen via Hot‑Wallet Breach
Current overview (not historical)
Investigators have linked Binance’s largest ever hack—$6.3 billion in stolen funds—to North Korean actors. The attackers exploited a vulnerability in Binance’s hot‑wallet signing infrastructure, enabling unauthorized transfers that were later laundered through mixing services. While the flow of the stolen assets is still being tracked, the case underscores the vulnerability of centralized hot‑wallet systems and the growing reach of state‑backed cyber‑criminal groups.
Written with AI from the reporting · updated 10/30/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 30, 00:00recorded Oct 31, 06:14single source
调查人员将60亿美元Binance黑客攻击追溯至朝鲜
Read original source ↗ The BlockReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- North Korea
- Action：
- compromised hot-wallet signing infrastructure
- Object：
- Binance
- Occurred (fact side)：
- Oct 30, 00:00
- Published (valid side)：
- Oct 31, 05:20
- First seen (known side)：
- Oct 31, 06:14
Fact stationSingle source · one-sided claimCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- The BlockSelectedRelated fact: single sourceBinance Hit by $6.3 B Hack Linked to North Korea
Report first recorded Oct 31, 06:14
Investigators have traced a $6.3 billion theft from Binance’s hot‑wallet signing infrastructure to a North Korean threat actor. Attackers exploited a vulnerability in Binance’s hot‑wallet signing system to authorize unauthorized transfers, then moved the stolen funds through a series of mixing services to obscure their trail. The incident remains under investigation, with authorities tracking the flow of the compromised assets.
Read original source ↗
Event activity trend
- Latest comparable
- 3
- Comparable peak
- 10Oct 31, 07:00
- 24h change
- -50%
The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.