INCIDENT REPORT · CP-2026-008

Binance exchange theft

L3 · ELEVATEDCONFIRMED

Attackers drained about $6.3 billion in virtual assets from Binance in what is reported as the largest cryptocurrency theft on record; the FBI attributed it to North Korea.

Incident ID: CP-2026-008
Incident date: 29 OCT 2026
Detection date: 29 OCT 2026
Affected countries: United Arab Emirates
Plotted location: Abu Dhabi, United Arab Emirates (Reported de facto base / ADGM-regulated entity; Binance has no formally declared global headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: Very large theft from a major cryptocurrency exchange; rated consistently with other exchange thefts (e.g. Bybit) as there was no demonstrated disruption of essential financial infrastructure.
Attack type: Cryptocurrency Theft
Nature: Malicious activity
Attack vector: Binance's initial investigation: a compromised DevOps engineer's laptop gave access to a service container used to submit unauthorized withdrawal transactions; no evidence of private-key leakage
Sectors: Finance
Critical infrastructure: No
Organizations affected: Binance
Operational consequences: Binance paused withdrawals, worked with partners to freeze about $3 billion on-chain, and said it covered user losses from its SAFU fund and company funds; withdrawals reopened on 1 November 2026 according to reporting.
Estimated financial impact: $6.3B — Binance estimated total impact of around $6.3 billion; FBI alert cites more than $6 billion. Third-party estimates range to $6.36-6.43 billion.
Attribution (as stated): Attributed by FBI to North Korea (TraderTraitor); North Korea denied involvement

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Binance exchange theft

L3 · ELEVATEDCONFIRMED

Attackers drained about $6.3 billion in virtual assets from Binance in what is reported as the largest cryptocurrency theft on record; the FBI attributed it to North Korea.

Incident ID

CP-2026-008

Incident date

29 OCT 2026

Detection date

29 OCT 2026

Affected countries

United Arab Emirates

Plotted location

Abu Dhabi, United Arab Emirates (Reported de facto base / ADGM-regulated entity; Binance has no formally declared global headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Very large theft from a major cryptocurrency exchange; rated consistently with other exchange thefts (e.g. Bybit) as there was no demonstrated disruption of essential financial infrastructure.

Attack type

Cryptocurrency Theft

Nature

Malicious activity

Attack vector

Binance's initial investigation: a compromised DevOps engineer's laptop gave access to a service container used to submit unauthorized withdrawal transactions; no evidence of private-key leakage

Sectors

Finance

Critical infrastructure

Organizations affected

Binance

Operational consequences

Binance paused withdrawals, worked with partners to freeze about $3 billion on-chain, and said it covered user losses from its SAFU fund and company funds; withdrawals reopened on 1 November 2026 according to reporting.

Estimated financial impact

$6.3B — Binance estimated total impact of around $6.3 billion; FBI alert cites more than $6 billion. Third-party estimates range to $6.36-6.43 billion.

Attribution (as stated)

Attributed by FBI to North Korea (TraderTraitor); North Korea denied involvement