As of 30 Oct 2026, the question of who hacked Binance does not yet have a court-tested answer. What exists so far is an attribution claim made by investigators: TRM Labs traced the breach to a North Korean unit known as TraderTraitor, and other trackers also pointed to North Korea. That distinction matters, because a tracing claim by investigators is not the same as a finding by a court.

Pyongyang has previously denied hacking allegations, and that denial is part of the public record around earlier cases. No court finding on this Binance breach has been reported in the facts available so far, so readers should treat the North Korea link as an investigators' claim that remains subject to further evidence and official proceedings.

The breach itself took place on 29 Oct 2026 at Binance, described as the world's largest crypto exchange. Its estimated impact is about $6.3 billion, which would make it the largest crypto theft on record, surpassing the $1.5 billion Bybit theft in 2025. Those figures are preliminary estimates, and the investigation is ongoing.

The preliminary investigation points to a compromised laptop belonging to a DevOps engineer. Investigators say that access may have let an attacker reach a service container and submit unauthorised withdrawal transactions. At the preliminary stage, no evidence of a wallet private key leak has been found, but that assessment could change as the investigation continues.

A reported mechanism centres on a wallet called Binance 14, which appeared in Binance's 1 Oct proof of reserves. According to reports, the attacker used an Ethereum feature known as EIP-7702 on that wallet, turning it into a sweeper. Around 204,500 ETH moved in the incident, leaving ETH backing near 94 percent, down from 100 percent on 1 Oct.

Binance co-CEO Yi He has said all losses will be covered from company funds plus the SAFU emergency fund, and that user funds are safe. The SAFU fund holds about $1 billion in bitcoin. Deposits and withdrawals were suspended as a precaution, and Yi He said she expects withdrawal resumption to begin within the next 48 hours.

Some reports have said deposits were unaffected, which differs from the account of a suspension covering deposits as well. That discrepancy should be noted honestly: the available facts do not settle it with certainty, and readers should rely on official Binance channels for the current status rather than treating either version as confirmed.

About $3 billion has been frozen so far, including $2.3 billion in USDT and USDC. Tether froze more than $1.567 billion in USDT, Circle froze about $823 million in USDC, Ripple froze about $200 million, and World Liberty Financial froze $27 million in USD1. The market also reacted sharply, with Bitcoin falling below $77,000, ether down about 3.2 percent, BNB down about 3.9 percent, and more than $1 billion in leveraged positions liquidated in 24 hours.

FAQ: Who do investigators blame for the Binance hack? TRM Labs traced it to the North Korean unit TraderTraitor, with other trackers also pointing to North Korea, but this is an investigators' claim, not a court finding. Has a private key leak been confirmed? No, the preliminary investigation found no evidence of a wallet private key leak. What happens next? The next proof-of-reserves snapshot is due on 1 November 2026, and it will show whether stolen assets were replaced.