Binance Hack: North Korea's TraderTraitor Blamed for the $6.43 Billion Theft, Stolen Funds Traced Through Home-Made Meme Coins, and What Businesses Should Check
Attackers drained Binance wallets across 11 blockchains on October 29, 2026. Researchers have now traced about $430,000 of the stolen funds through home-made meme tokens. Here is what is confirmed, what is not known, and what to check this week.
Where Worldwide
On this page 9 sections
North Korea-linked hackers drained Binance wallets on October 29, 2026, in a theft reported at $6.43 billion, and researchers say part of the money is being moved through home-made meme tokens. If your business accepts, holds or processes crypto, this matters because stolen funds pass through ordinary services on the way out, and yours could be one of them.
This post covers what happened after the theft: where the money went, what is confirmed, what is still unknown, and what to check this week.
What happened in the Binance hack
According to GBHackers, attackers drained Binance wallets across 11 blockchains on October 29, 2026. The same report calls it the $6.43 billion Binance theft.
The trail grew fast. By November 9, the report says, the activity being tracked covered more than 20,000 wallets, 16 blockchains, at least 36 services and 65,000 transactions. Put simply, in the eleven days after the theft the money spread from 11 blockchains to 16 and passed through dozens of services.
Who is behind the Binance hack
GBHackers reports that the FBI attributed the theft to North Korea's TraderTraitor group on October 31, two days after the wallets were drained.
We have not reviewed the FBI's own statement. Treat the attribution as reported, not as something we checked at the source. Our sources also say nothing more about TraderTraitor beyond the name and the link to North Korea.
How the stolen Binance crypto is being laundered through meme coins
Elliptic's researchers report that about 117,000 NEAR (around $430,000) of the stolen funds passed through "home-made meme tokens on NEAR".
For scale, $430,000 is well under one tenth of one percent of the reported $6.43 billion. The amount is not the point. What matters is the method: instead of sending money straight from one wallet to the next, the stolen funds ran through tokens. Every extra step like that puts more distance between the theft and wherever the money ends up, and makes it harder for the next service in line to see where it came from.
Our sources do not say how much of the rest of the money moved this way, or which other methods were used.
What is confirmed and what is only claimed
| Statement | Where it comes from | Status |
|---|---|---|
| Binance wallets drained across 11 blockchains on October 29, 2026 | GBHackers news report | Reported |
| The theft totals $6.43 billion | GBHackers news report | Reported |
| FBI attributed the theft to North Korea's TraderTraitor group on October 31 | GBHackers news report | Reported, FBI statement not reviewed by us |
| By November 9: more than 20,000 wallets, 16 blockchains, at least 36 services, 65,000 transactions | GBHackers news report | Reported |
| About 117,000 NEAR (around $430,000) passed through home-made meme tokens on NEAR | Elliptic, the researchers' own write-up | Researchers' findings |
We had no statement from Binance itself among our sources.
What is not known yet
The sources we used do not say:
- How the attackers got into the Binance wallets.
- Whether customer balances were affected, or only Binance's own wallets.
- How much, if any, of the money has been frozen or recovered.
- Which of the 36 or more services the funds passed through.
- What Binance itself has said about the theft.
If you see claims about any of these, check where they came from before acting on them.
Why the Binance hack matters for a business
If you accept crypto payments. Stolen funds had already passed through at least 36 services by November 9. A payment that reaches your wallet could have come down that trail, and you want to know before you ship goods or release a service, not after.
If you run a fintech, payments or crypto platform. Your platform could be one of those services. Funds moving through freshly made, little-known tokens is exactly the kind of pattern your monitoring should flag for a person to review.
If you never touch crypto. The lesson still applies. The reported attackers are a state-linked group that went after one of the biggest targets there is. Any account that can move money, whether that is banking, payroll, an exchange account or the admin panel of an online store, deserves the same care. Once money leaves, it splits across many places within days.
What to do this week
| Who | What to check | How |
|---|---|---|
| Businesses that accept crypto | How incoming funds are screened | Ask your payment processor or wallet provider how it checks where incoming funds came from, and what happens if a payment is flagged |
| Businesses holding crypto on an exchange | Who can move it | List every person and device that can approve withdrawals and remove anyone who does not need that access |
| Fintech and crypto platforms | Funds passing through new, low-value tokens | Review recent flows against published research such as Elliptic's write-up, and make sure flagged activity goes to a person |
| Every business | Accounts that move money | Turn on multi-factor sign-in for banking, payroll and exchange accounts, and require a second person to approve large transfers |
| Every business | A plan for when money goes missing | Write down who you call first: your bank, your provider, law enforcement and your IT team. Our post on who to call when systems break covers this |
One more point: big thefts are often followed by scam messages pretending to be from the affected company. If you have a Binance account, go to the service directly rather than following links in emails or texts.
Binance hack questions people are asking
Was Binance hacked?
According to GBHackers, attackers drained Binance wallets across 11 blockchains on October 29, 2026. We have not reviewed a statement from Binance itself.
How much was stolen in the Binance hack?
The theft is reported at $6.43 billion.
Who hacked Binance?
GBHackers reports that the FBI attributed the theft to North Korea's TraderTraitor group on October 31.
What is TraderTraitor?
Our sources describe it only as a North Korea-linked group, North Korea's TraderTraitor group. They give no further detail.
How is North Korea laundering the stolen crypto?
Elliptic traced about 117,000 NEAR, around $430,000, through home-made meme tokens on NEAR. The sources do not describe every method in use.
How far has the stolen money spread?
By November 9, the tracked activity covered more than 20,000 wallets, 16 blockchains, at least 36 services and 65,000 transactions, according to GBHackers.
Is my Binance account affected?
Our sources do not say whether customer accounts were affected. Check through Binance's official app or website, never through a link in a message.
Can the stolen crypto be recovered?
Our sources do not say how much, if any, has been frozen or recovered.
The bigger lesson
In under two weeks, money stolen in one day spread across 16 blockchains and at least 36 services. After that point, nobody gets it back by acting fast. The protection that works comes before the theft: knowing who can move money, requiring a second approval, and noticing quickly when something looks wrong.
If you want the accounts and systems that move your money locked down before someone tests them, see security hardening or request a quote.
Get security alerts like this by email, along with the free checklist, at security alerts.
Sources: Elliptic: North Korea, meme coins and the Binance hack; GBHackers: DeFi liquidity pools report.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
SQL Server Malware: Internet-Facing Microsoft SQL Servers Hit With a Monero Miner and Gh0st RAT, What Is Confirmed and What to Check This Week
Fortinet researchers found an active campaign against internet-facing Microsoft SQL Servers. Attackers install...
Fireworks AI Breach: A Hacked Cloud Provider Let Attackers Reach Customer Billing Data, Datasets and Model Weights, and What to Do Now
Fireworks AI says attackers used a hacked third-party cloud provider to reach its development machines and cus...
iOS App Sandbox Bypass: Public worse_query Code Reaches Other Apps' Data on iOS 26 and 27.2, No Apple Fix Confirmed, and What to Do This Week
A developer has published worse_query, proof-of-concept code that lets an iPhone app reach other apps' data on...
