THE BIGGEST HEIST IN HUMAN HISTORY: WHO STOLE IT?

The Ledgers Investigation File — 1 November 2026

A country's budget in twenty minutes

Thursday night, 29 October. Money began leaving the wallets of Binance, the world's largest cryptocurrency exchange. First one wallet, then another. According to calculations by blockchain intelligence company TRM Labs, the attacker removed approximately $6.36 billion from Binance's control across ten separate blockchains. Most of it happened in about twenty minutes.

To put the figure in context: all cryptocurrency thefts worldwide in the whole of 2025 totalled $2.87 billion. More than twice that disappeared in one night. The previous record was the Bybit heist in February 2025: $1.5 billion. That, too, had made headlines as the "biggest in history". Binance quadrupled it.

On Friday morning, Binance suspended deposits and withdrawals. The cryptocurrency market was shaken: Bitcoin fell to a six-week low of $76,368; Ethereum dropped more than 3 per cent to $2,178. Coinbase shares lost 4.8 per cent; the company had to say, "This has nothing to do with us."

How did it happen? Nobody fully knows yet

Binance's initial statement was cautious: the incident might involve "a compromised laptop". According to Al Jazeera, it was an engineer's computer. The company then said that "other entry points" had also been found as the investigation progressed. But it insists on one point: "There is no evidence that any wallet private key was leaked."

Not everyone is convinced. Former Mt. Gox boss Mark Karpelès told Reuters that the attackers "very likely gained access to the keys of at least two Binance wallets". The assessment of Kok Tin Gan, founder of cybersecurity company NyxLab, is even more troubling: "A single signature appears to have given the attacker a fully authorised access key to a Binance hot wallet that never expires."

In a five-minute video posted on X, Binance co-CEO Richard Teng said the attack had targeted the company's own hot wallet, that the "vast majority" of assets were "in cold wallets", and that this was not a one-person operation. He also offered an interesting detail: the attackers had used a "self-destruct mechanism" that made tracing them harder.

In short: the official account says, "The computer was compromised, the key was not leaked." Outside experts say, "This cannot happen without the key." Both cannot be true at once. That question remains open.

"Your money is safe"

Changpeng Zhao, or CZ, is still a major Binance shareholder. His first message on X was three words: "User funds safe!" He then added: "This looks like a hack against Binance. As a shareholder, I expect all user funds to be fully covered."

SAFU, the emergency fund Binance established in 2018, is worth $1 billion and is held entirely in Bitcoin. The stolen money is more than six times that amount. The company said it would cover the shortfall from its own coffers; according to AP, Binance allocated more than $6.34 billion of company funds for this purpose. It announced that approximately 90 per cent of the stolen assets had been replaced as of Saturday and that it aimed to resume withdrawals on Sunday.

Meanwhile, approximately $3 billion of the money was frozen. According to Reuters, stablecoin issuers Tether and Circle froze more than $2.3 billion of it; in other words, the USDT and USDC in the thieves' hands suddenly became worthless paper. Binance has not yet said anything about what happened to the remaining $3.3 billion.

Pyongyang's fingerprint

Hours after the heist, TRM Labs published a blog post linking the attack to North Korea's elite hacking unit TraderTraitor. The wording was forceful: "We make this assessment with high confidence." Its reasoning was the attack's "fingerprint": the way Binance wallets were drained into wallets controlled by the attacker was an exact copy of the Bybit heist.

Chainalysis founder Jonathan Levin reached the same conclusion, writing that the attack was "very likely" the work of TraderTraitor.

TraderTraitor is an offshoot of the Lazarus Group, which the US Treasury placed on its sanctions list in 2019 and linked to North Korea's main intelligence bureau. Its record stretches from the 2014 Sony Pictures attack to the 2025 Bybit heist.

The FBI also stepped in on Saturday. In a statement prepared jointly with the US Secret Service and IRS Criminal Investigation, the FBI announced that it "assessed" North Korea to be behind the 29 October heist. It said the attackers had mostly converted the stolen assets into Ethereum and would continue doing so through DeFi protocols and instant swap services. It called on the entire industry, from THORNode operators to RPC nodes and from instant exchanges to blockchain analytics companies, not to transact with the listed addresses.

At the White House, Trump was asked about North Korea's involvement. His answer: "We're looking at it."

Binance itself, however, has not accused anyone. In Teng's words: "Our investigation has not attributed responsibility to any individual."

Money for missiles?

This is where the truly frightening part begins. Why does North Korea steal cryptocurrency? For a country under sanctions whose foreign trade has been reduced to almost nothing, cryptocurrency theft is the most profitable way to earn foreign currency. Western intelligence agencies and experts have said for years that this money finances Pyongyang's nuclear and ballistic missile programmes.

A few figures to convey the scale. In 2022, South Korean intelligence estimated that North Korea had stolen $1.1 billion in cryptocurrency over five years. According to CertiK, actors linked to North Korea alone accounted for more than $2 billion, or about 60 per cent, of the world's total $3.4 billion in cryptocurrency losses in 2025. North Korea's annual defence spending, meanwhile, is estimated at around $6 billion, although the margin of uncertainty is high.

So if the attribution is correct, the Kim Jong Un regime took the equivalent of its own annual military budget from a single exchange in one night. In the words of TRM's head of policy, Ari Redbord: "This is no longer just a cryptocurrency theft, but a global security issue."

But honesty is needed here. The statement "the stolen money is going to missiles" is an expert assessment and an intelligence inference; there is no document showing which missile or which programme this money is going to. The logic is strong; the evidence is indirect.

What is certain, and what is alleged?

What is certain: Approximately $6.3 billion left Binance wallets on 29 October. The company's hot wallet was affected. Approximately $3 billion was frozen. Binance suspended transactions, said it would cover the shortfall from its own funds, and set aside $6.34 billion for that purpose.

Strong but unofficial assessments: TRM's and Chainalysis's attribution to North Korea is analysis by private companies. The FBI's "assessment" is a law-enforcement opinion, not a court ruling. No court has convicted anyone, Binance has accused no one, and North Korea denies everything as usual.

What has not yet been disclosed: The actual technical route of the attack. Whether a key was leaked. Where the unfrozen $3.3 billion is. Whether the SAFU fund was used. The exact time of the heist. The FBI's full address list.

Why does it matter?

This file tells two stories at once. First: through a single employee's computer, the world's largest cryptocurrency exchange lost as much money as a country's budget in twenty minutes. Even if "user funds are safe" is true, securing them with a $6 billion shareholder cheque does not mean the system itself is secure.

Second: in a world where sanctions are said to work, if a sanctioned regime can extract $6 billion from the global financial system in one night, sanctions themselves must be questioned. The money may have come from Binance's coffers; but the real question is where its journey will end.

The Ledgers will continue to follow this file. The fate of the frozen $3 billion, Binance's technical investigation report, and tracing the money through the FBI's address list will be the subject of the next instalment.

Sources

• Al Jazeera — Binance says $6.3bn stolen in biggest crypto heist in history: What we know
• CBS News — $6.3 billion Binance hack was likely work of North Korea, blockchain intel firms say
• PBS NewsHour / AP — What to know about the $6.3B hack on Binance
• NPR — Blockchain intelligence firms link North Korea to $6.3B hack on Binance
• Anadolu Agency — FBI blames North Korea for $6.3 billion cryptocurrency theft
• Cointelegraph TR — FBI blames North Korea for Binance attack
• Yahoo Finance — Reports Say North Korea's Lazarus Group Likely Behind Binance Hack