The global cyber war · Banks, exchanges and theft

Binance halts withdrawals after a security incident; billions in crypto taken from its hot wallets

Reported4 distinct origins, 0 independent.

Binance said on 29 October it was investigating a potential security issue and temporarily halted withdrawals across multiple networks, TechCrunch reported. BleepingComputer put the theft at about $6.36 billion across ten blockchains, and the FBI later said more than $6 billion was stolen on or about 29 October. Binance said it would bear the financial impact of the stolen funds, and planned to resume the first phase of withdrawals on 1 November. On 31 October the FBI said North Korea was responsible.

When: 29 October 2026
Where: No fixed place, No single country
What: cyber, financial
Acting party: Government of North Korea (DPRK), including the Korean People's Army
Attribution: Attributed by independent sources. The FBI said on 31 October that North Korea was responsible for the theft and tied it to the actor it calls TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38. By 30 October the blockchain analysis companies TRM Labs (on 29 October, with high confidence) and Chainalysis (as likely) had attributed the theft to TraderTraitor, AP reported. No North Korean response was found. President Trump said on 31 October that it was not known whether North Korea was behind it.
In the record: Published 2026-11-09 22:52 UTC · changed 1 time since · backfilled

Sources

Evidence TechCrunch Media · Not yet classified origin: Binance statements, 29 Oct to 1 Nov · published 2026-10-29 00:00 UTC aware of reports of a potential security issue and are actively investigating.
Corroboration BleepingComputer Media · Not yet classified origin: Binance statements, 29 Oct to 1 Nov · published 2026-11-01 00:00 UTC Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds.
Evidence BleepingComputer Media · Not yet classified origin: FBI statement, 31 Oct · published 2026-11-01 00:00 UTC
Evidence Hawaii News Now Media · Not yet classified origin: TRM Labs analysis, 29 Oct · published 2026-10-30 00:00 UTC
Evidence Hawaii News Now Media · Not yet classified origin: Chainalysis analysis, by 30 Oct · published 2026-10-30 00:00 UTC

History

First recorded 9 Nov, 22:52 UTC, as reported (one origin only).
10 Nov, 19:23 UTC: basis for the status changed from one origin only to origins from one side only. Daily record, window 2026-11-10T12Z: a later window added citations or corrected the record; checked again against the one rule

Cite or reuse

The War Record, "Binance halts withdrawals after a security incident; billions in crypto taken from its hot wallets", record ev-20261109-tnk5, version 2, https://thewarrecord.com/events/ev-20261109-tnk5/

This month's events as JSON (id ev-20261109-tnk5) · CC BY 4.0