Investigators Say North Korea Just Pulled Off the Biggest Heist Ever and It Only Took Twenty Minutes

In September, FBI agents raided about 40 Texas locations where laptops allegedly quietly funneled American paychecks to North Korea.

Five weeks later, a blockchain firm says North Korean hackers pulled a separate job and hit a jackpot nobody has ever seen.

The biggest robbery ever recorded just went down, and it was over faster than an episode of Cheers.

The Haul Was More Than Four Times the Old Crypto Record

The target was Binance, the largest cryptocurrency exchange on the planet.

Binance estimated the damage at about $6.3 billion.

Blockchain intelligence firm TRM Labs put the figure even higher, at roughly $6.36 billion pulled out of Binance wallets on ten separate blockchains.

Most of it vanished in about 20 minutes, starting just after 4 p.m. Eastern on October 29.

In TRM's words, it is "the largest crypto theft on record."

It is not close.

The haul is more than four times the $1.5 billion taken from the Dubai-based exchange Bybit in February 2025, which held the old record.

TRM alleges, with what it calls high confidence, that the attack was carried out by TraderTraitor – a state-sponsored hacking unit it says operates out of North Korea.

The FBI blamed that same unit for the Bybit theft.

The FBI has not attributed the Binance attack to anyone, and Binance has not published a root cause.

One Engineer's Laptop May Have Opened the Vault

Binance said the breach may trace back to a single compromised laptop belonging to a DevOps engineer.

That foothold reportedly let the attacker get inside a service container and start pushing through withdrawals nobody authorized.

This was not a smash-and-grab.

TRM found the preparation began at least 36 hours earlier, with small withdrawals through the crypto mixer Tornado Cash starting October 28.

Binance says it has seen no sign that a wallet's private key was exposed, and it has pledged a full accounting once its review is complete.

The exchange froze affected assets and vowed to make customers whole.

Stablecoin issuers Tether and Circle froze stolen tokens too, and the frozen total climbed to roughly $3 billion.

The thieves were in such a hurry to cash out that they dumped about $325 million in stolen Tether on market makers at a discount of more than 10 percent.

TRM says the attacker still controls roughly $2.4 billion in crypto that nobody has managed to freeze.

The FBI said it is "engaged with relevant public and private partners" to assess what happened.

After Bybit, the Bureau warned that the thieves had scattered the loot across thousands of wallets and urged crypto companies to block the transfers.

Speed is the whole game, because every hour the money keeps moving is another hour to launder it.

North Korea Has Turned Crypto Theft Into a Weapons Budget

This is not a gang of teenage hackers in a basement.

U.S. intelligence has assessed that crypto heists and other financial crimes bring Pyongyang at least $1 billion a year for its weapons programs.

In 2022, North Korea's Lazarus Group stole more than $600 million from the Ronin network behind the video game Axie Infinity.

TRM says the Binance attack shares hallmarks with both Bybit and the April 2026 KelpDAO hack.

The regime runs a second pipeline right here at home.

Those Texas raids netted more than 185 laptops and devices tied to North Korean IT workers posing as American remote employees.

U.S. Attorney Ryan Raybould didn't buy the innocent-host excuse: "If you're an individual, and you have 50 laptops in your family room, you're doing something wrong."

The Treasury Department estimated more than $800 million flowed to North Korea from that kind of scheme in fiscal year 2024 alone.

The workers send as much as 90 percent of their paychecks straight back to the regime.

If TRM Is Right, Binance's Money Is Headed for Kim Jong Un's Arsenal

Kim Jong Un's missile program does not run on rice and propaganda.

He cannot sell enough coal or knockoff cigarettes to pay for intercontinental ballistic missiles.

So he steals it – from American companies, from crypto exchanges, and from the ordinary investors who trust them with their savings.

If the allegation holds, six billion dollars is no rounding error for a country whose entire economy is smaller than many American states.

Money like that buys rocket fuel and missiles that can reach Guam, Seoul, Tokyo, and the West Coast.

The FBI moved fast on the Texas laptop farms.

The next step has to be just as fast and a lot more painful for Pyongyang.

Every exchange, every crypto firm, and every company hiring remote coders needs to treat one unlocked laptop like an open door for North Korean hackers.

Whoever hit Binance just proved that door can swing open in twenty minutes.

Sources:

• Kevin Killough, "North Korean Unit Likely Behind $6.3 Billion Hack on Binance, Blockchain Intelligence Firm Says," Just The News, October 30, 2026.
• TRM Labs, "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History," TRM Labs, October 29, 2026.
• David DiMolfetta, "FBI Is Involved in Response to $6.3 Billion Binance Hack Linked to North Korea," Nextgov/FCW, October 30, 2026.
• Grace Marocco and Shaun Rabb, "FBI Raids Texas 'Laptop Farms' Helping North Korea Fund Nuclear Weapons," FOX 4 News, October 13, 2026.