United States: more than €1.09 billion of crypto stolen from Binance frozen after giant hack attributed to North Korea
After about €5.69 billion of digital assets were stolen from Binance on October 29, 2026, the U.S. Department of Justice announces it has frozen more than €1.09 billion linked to the attack. This case mixes a sophisticated hack, the involvement of a state actor and massive intervention by authorities, with consequences for all crypto holders.
- Bitcoin
- €61,520
- −7.62% over 24 h
- Ether
- €1,728
- −6.69% over 24 h
- Market mood
- 20 / 100
- Extreme fear
- Bitcoin's share
- 59%
- of the total market
A record hack on Binance, billions gone in a few hours
On October 29, 2026, Binance announced that part of its “hot” wallets, meaning wallets permanently connected to the internet to process withdrawals, had been compromised. The platform spoke of a loss of about $6.3 billion, or nearly €5.69 billion, drained in a few hours across multiple blockchains.
In an investigative report published on November 3, 2026, Binance specified that about $6.34 billion, or €5.73 billion, of assets were affected by the incident. The difference with the first figure comes from the fact that the second includes a more comprehensive measure of exposed funds, established a few days after the initial shock.
Binance describes a multi-stage attack carried out over several months, rather than a simple opportunistic theft. The attackers allegedly began in September 2026 with fake job offers, a so-called social engineering technique aimed at tricking employees to obtain sensitive internal access.
According to Binance, the hackers then compromised internal artificial intelligence tools, which allowed them to better understand certain technical systems of the platform. They ultimately abused a new Ethereum network feature, called EIP-7702, which allows delegation of signing rights on a wallet, to take control of a hot wallet.
Among the transactions detailed by Binance, one transferred 18,270 bitcoins from a platform hot wallet to an address controlled by the attacker on October 29, 2026. Binance says it quickly suspended withdrawals to contain the attack, then cooperated with partners to attempt to freeze part of the stolen funds.
A race against time to freeze the stolen funds
In its November 3, 2026 report, Binance states that about $2.85 billion, or €2.58 billion, had already been frozen or intercepted as of October 31, 2026. This freezing was made possible thanks to cooperation from technical partners and stablecoin issuers, tokens that track the value of a currency like the dollar.
Issuers of some stablecoins can indeed block tokens linked to suspicious addresses, because they control the smart contract that governs those assets. This gives a significant lever to respond to a hack, but it also shows that these assets are not always as “uncontrolled” as some users may think.
On November 12, 2026, the U.S. Department of Justice announced it had obtained court orders to seize or freeze more than $1.2 billion, or about €1.09 billion, of crypto-assets recently stolen from Binance. According to the press release, these amounts represent a substantial portion of the initial haul, even if the total remains far from fully recovered.
According to the same press release, combined actions by U.S. authorities and private partners had allowed more than $2.7 billion, or about €2.44 billion, of assets related to the theft to be frozen in total. The difference with the figures published earlier by Binance is due to the Department of Justice aggregating several waves of freezes conducted up to November 12, 2026.
The U.S. Department of Justice explains that the tracking of funds and forfeiture proceedings are ongoing, which means the amount actually recovered could still change. Practical questions also remain, such as how any seized funds would be managed or returned, which have not yet been detailed beyond this press release.
An attack attributed to a group of North Korean hackers
The FBI and the U.S. Department of Justice explicitly attribute the theft of more than $6 billion, or about €5.42 billion, to a group of North Korean military hackers. This group is referred to as “TraderTraitor” and had previously been linked to other campaigns targeting crypto-related services.
According to the November 12, 2026 press release, U.S. authorities had issued, in late October 2026, an alert asking platforms to block addresses associated with this group. This alert aimed to limit the possibilities for the hackers to move or convert the funds, since every transfer on a blockchain leaves a permanent and public trace.
The Department of Justice used this announcement to recall another North Korea-linked campaign, called “FaceStealer.” According to the same document, that campaign of manipulation and false identities allegedly enabled the theft of more than $400 million, or about €361 million, of crypto over an 18-month period.
These elements show that the Binance hack would not be an isolated incident, but part of a broader strategy of illicit crypto financing linked to North Korea. U.S. authorities have for several years pointed to the use of digital thefts by that country to circumvent certain international sanctions.
U.S. services do not detail, in these documents, exactly how the stolen funds would be used by North Korea, which remains difficult to trace with certainty. They do, however, emphasize the repetition and scale of attacks targeting centralized platforms, fueling debates about the overall security of the crypto ecosystem.
Consequences for users and questions still open
Even for a crypto holder who does not use Binance, this hack raises several concrete questions. It first shows that a wallet managed by a centralized platform, especially if it is permanently connected, remains a prime target for professional hackers, including those linked to states.
As a reminder, a so-called “hot” wallet is a wallet connected to the internet to facilitate rapid deposits and withdrawals, but it is more exposed to cyberattacks. Conversely, a so-called “cold” wallet is kept offline, which makes it less convenient for daily use but generally harder to attack remotely.
Binance says it has fully covered losses for its users, but the details of this coverage or its impact on the company’s equity are not detailed in the documents reviewed. The platform also announces an independent security review and an update of its “proof of reserves,” that is a mechanism that claims to show the holdings it controls.
For U.S. authorities, this case also provides a concrete example of how states can use crypto attacks to finance illicit activities. It could feed regulatory discussions on monitoring obligations, enhanced identity checks and cooperation between platforms and authorities, particularly in the United States.
For individuals, this case finally illustrates that security does not depend solely on the technical quality of a blockchain like Bitcoin or Ethereum. It also depends on custody choices, the operational robustness of intermediaries and the collective ability, platforms and authorities alike, to react quickly when an incident of this scale occurs.
