Binance’s $6.3bn Hack: 5 Biggest Cryptocurrency Heists in History and Who Was Behind Them

Binance’s reported $6.3 billion security breach has pushed cryptocurrency theft to an unprecedented level, surpassing previous attacks on major exchanges and blockchain platforms.

The October 29 incident is estimated to have affected approximately $6.36 billion in digital assets across 10 blockchain networks, according to blockchain intelligence firm TRM Labs.

The firm has attributed the attack to TraderTraitor, a North Korean hacking unit, with high confidence. The same group was linked to the $1.5 billion Bybit cryptocurrency theft in February 2025.

The incident adds to a growing list of major cryptocurrency heists involving hundreds of millions of dollars in stolen digital assets. Some have been linked to organised hacking groups, while others remain unresolved.

Here are five of the biggest cryptocurrency thefts and the hackers suspected of carrying them out.

1. Binance: $6.36 billion (2026)

Binance suffered what TRM Labs described as the largest cryptocurrency theft on record on October 29, 2026.

The attack affected wallets across 10 blockchain networks, including Bitcoin, Ethereum, Tron, Solana and XRP.

According to TRM Labs, the attacker moved most of the funds within approximately 20 minutes.

The firm attributed the operation to TraderTraitor, North Korea’s elite hacking unit, citing similarities with previous attacks linked to the group.

Several cryptocurrency companies, including Tether and Circle, worked to freeze affected assets. Approximately $2.7 billion had been frozen by October 30.

Binance also pledged to cover the losses and assured customers that their funds were safe.

2. Bybit: $1.5 billion (2025)

Before the Binance incident, cryptocurrency exchange Bybit suffered the largest recorded crypto theft in February 2025.

Hackers stole approximately $1.5 billion in digital assets from an Ethereum cold wallet used by the exchange.

The attackers reportedly compromised a developer’s computer and manipulated the transaction interface used by Bybit’s wallet signatories.

This allowed them to disguise a malicious transaction as a legitimate transfer.

The FBI attributed the attack to North Korean hackers operating under the name TraderTraitor.

The incident became one of the most significant cryptocurrency security breaches before the Binance attack.

3. Ronin Network: $625 million (2022)

In March 2022, hackers stole approximately $625 million from the Ronin Network, a blockchain platform connected to the popular online game Axie Infinity.

The attackers compromised validator keys that controlled the network’s bridge, allowing them to authorise fraudulent withdrawals.

The FBI later attributed the attack to North Korea’s Lazarus Group.

The theft involved approximately 173,600 Ethereum and 25.5 million USDC tokens.

The incident exposed security weaknesses in blockchain bridges, which allow users to transfer digital assets between different networks.

4. Poly Network: $610 million (2021)

Poly Network suffered one of the largest decentralised finance attacks in August 2021.

Hackers exploited a vulnerability in its cross-chain infrastructure, stealing approximately $610 million in different cryptocurrencies.

The attacker initially controlled assets worth hundreds of millions of dollars across several blockchain networks.

However, the incident took an unusual turn when the hacker began returning the stolen funds.

Poly Network eventually recovered nearly all the assets, making the incident different from several other major cryptocurrency thefts.

The attacker’s identity was never conclusively established.

5. Coincheck: $530 million (2018)

Japanese cryptocurrency exchange Coincheck suffered a major security breach in January 2018.

Hackers stole approximately $530 million worth of NEM cryptocurrency from the platform’s online wallet.

The attack raised concerns about how cryptocurrency exchanges stored and protected customers’ digital assets.

South Korea’s intelligence agency subsequently suggested that North Korean hackers might have been responsible, although the attribution was not conclusively established.

Coincheck later announced plans to compensate affected customers.

North Korean hackers and cryptocurrency theft

The suspected involvement of North Korean hacking groups in several major cryptocurrency attacks has drawn attention to the security challenges facing the industry.

The Lazarus Group and its associated operations have been linked by investigators to major cryptocurrency thefts, including the Ronin and Bybit attacks.

With TRM Labs now attributing the Binance incident to TraderTraitor, the latest breach has renewed concerns about the ability of organised hacking groups to exploit vulnerabilities in cryptocurrency infrastructure.

However, investigations into the Binance incident are ongoing, and the full circumstances surrounding the attack are yet to be established.