The Largest Crypto Heist in History Could Have Been Avoided

At 4 p.m. on October 29, 2026, hackers began a 20-minute operation that would result in the largest crypto heist in history. Binance—the world’s biggest crypto trading platform—fell victim to a North Korean hacking group known as “TraderTraitor” that drained more than $6 billion from multiple blockchains. Although Binance managed to freeze around 44 percent of the stolen funds in the immediate aftermath, the remainder, in bitcoin and ether, will effectively be impossible to recover.

This incident has an unfortunate air of inevitability about it. The cryptocurrency industry has been a target of high-profile cyber-enabled heists over the past decade. And the hacking group involved is the same actor responsible for the last record-breaking crypto heist against Bybit in February 2025, which resulted in $1.5 billion lost. The beneficiary could not be starker: a hostile North Korean regime able to profit directly from U.S. dollars, circumventing U.S. sanctions and funding its defense program.

Blockchain technology itself is practically impossible for any one individual to alter. However, the exchanges on which cryptocurrencies are traded are vulnerable to hacking, as are the companies themselves. Until the cryptocurrency industry takes cybersecurity seriously, these types of operations will continue to occur and will rise in scale, undermining long-term efforts to protect international security.

How the Attack Took Place

The postmortem of the incident revealed that it was a monthslong operation achieved through a mix of social engineering tactics and bold technical expertise. North Korean hackers staged an elaborate social engineering operation that targeted a Binance employee through LinkedIn. They orchestrated a series of fake interviews, eventually convincing the employee to download a malicious assignment that would allow the hackers to gain access to the company’s internal system. Alongside this operation, hackers also used a targeted ad campaign that successfully led to a separate Binance employee unknowingly downloading a piece of malicious software. Once inside, the hackers moved at pace to access Binance’s wallets and transfer money out of the company.

The evidence base points to deep preparation for the attack, including persistent access into Binance’s systems, extreme speed to obscure the movement of funds, and destroying evidence as the attack ran—hallmarks of sophisticated state cyber actors at play. Although reporting suggests that the threat actors exploited an internal AI tool present within Binance’s systems as an entry vector, the majority of the operation took place without AI agents involved. Even the remarkable speed with which the money was laundered across wallets—TRM Labs measured the majority of the cryptocurrency leaving Binance wallets within around 20 minutes—likely involved regular automation (i.e., scripted software) rather than AI agents.

The attack is also directly out of North Korea’s playbook. Over the last decade, it has cultivated a highly skilled and successful cyber ecosystem to support its strategic objectives: regime survival, economic resilience (i.e., circumventing U.S. sanctions), and consolidation of its defense capabilities against South Korea, including building weapons of mass destruction and missiles. In addition to state-sponsored cyber actors such as Lazarus Group (of which TraderTraitor is thought to be a subset), North Korea also relies upon fake IT workers who fraudulently work for Western companies to raise funds, laundering the money via cryptocurrencies or facilitators in third countries.

Funding the North Korean Regime

North Korea immediately denied the FBI’s statement that it was responsible for the incident, leading to the sister of leader Kim Jong-un calling it a “grave political provocation.” Despite this, on- and off-chain intelligence reports have shown that the tactics, techniques, and procedures of the operation mimicked those of TraderTraitor and other North Korean hacking groups in the past. Unlike North Korea’s purely espionage operations, cryptocurrency heists are a highly lucrative tool used to evade heavy sanctions and fund its defense program, including its nuclear missile production program. Since 2017, North Korean hackers have stolen approximately $12.8 billion in cryptocurrencies, and approximately $7.8 billion of those stolen funds were from 2026 alone. A UN panel of experts found in 2024 that North Korea’s sanctions evasion was so successful that up to 40 percent of its defense budget was funded through stolen cryptocurrencies.

Not only are these well-planned operations, but they also demonstrate a complex money-laundering campaign at play, directly tied to the North Korean regime. In the case of Binance, the hackers have scattered the stolen money over 12,000 wallets, 11 blockchains, and over 40,000 transactions, equaling a new crypto wallet every 25 seconds. These operations also rely on global support; the laundered funds are usually sent to Chinese banks, where there is no obligation to provide real names or identities, effectively anonymizing the transactions that are then turned to liquid currency. As the funds from the Binance hack are being laundered, it remains to be seen what level of technological and military advancement the North Korean government will be able to achieve in the near future.

Most importantly, the money stolen in these operations subverts important measures put in place by the United States to constrain the North Korean state. This specifically includes sanctions evasion, as the cyber operations directly fund North Korea’s missile program. This funding is supplemented by regular cyber espionage activity that steals classified information from other countries on their nuclear weapons programs, as well as their missile designs, directly contributing to advancing North Korea’s defense objectives against the United States and allies. Considering that almost half of North Korea’s defense funding is supported by these heists, it is safe to assume that achievements in nuclear and missile production can be traced back to what was taken from the Binance hack.

This Hack Is Evidence That We’re Falling Short

The U.S. government’s longer-term response to cryptocurrency theft has been mixed. On the one hand, the Trump administration has actively engaged cryptocurrency firms as part of broader efforts to tackle cyber-enabled scams. This includes efforts such as the interagency Scam Center Strike Force, which targets scamcenters in Southeast Asia, where cryptocurrency companies have seized infrastructure and digital asset wallets. These seizures have helped prevent around $833 million in cryptocurrency from reaching malicious actors.

However, that action is distinct from the cryptocurrency companies themselves repeatedly being hacked. This is where the Trump administration’s response has fallen short: Its pro-innovation agenda has made it reluctant to regulate companies, not least given the president’s own interest and ties to the cryptocurrency industry. President Trump even pardoned Binance cofounder and former CEO Changpeng Zhao in October 2025 for money-laundering charges to which he pleaded guilty in 2023, under the mantle of ending the “war on crypto.” That decision effectively paved the way for U.S. citizens to trade on Binance, which until then had been restricted.

The result has been a lax environment for cryptocurrency companies. Binance co–chief executive officer Yi He even made a startling admission in the wake of this incident, stating that “we should have invested more in security earlier and set stricter standards,” referring to Binance’s previous major incident in 2016 when hackers stole 7,000 bitcoin (around $41 million). It is even more startling in the face of the theft of $1.5 billion from Binance’s competitor, Bybit, in 2025. Yi He even acknowledged that throughout 2026, Binance’s security team detected and prevented 57 suspected North Korea-linked cyber threat cases.” This raises the question: how much of a loss is enough for these companies to take cybersecurity seriously?

In August 2026, the Trump administration published a presidential memo setting out its intent to authorize offensive cyber operations by the private sector to directly combat cybercrime and cyber-enabled fraud. This incident lays bare its shortcomings: North Korea is known to rely upon state-sponsored cybercriminals—including Lazarus Group—for generating financial gain. And although cryptocurrency companies are best positioned to apply pressure to specific chokepoints that laundered funds pass through, the memo forbids private sector companies from targeting state-affiliated actors. This may be sensible from a risk and operational perspective, but it also collides with the realities of the cyber threat landscape.

Conclusion

The scale and speed of the Binance attack seem indicative of the moment we are in. Governments across the world are distracted, whether by elections, ongoing conflict, or domesticunrest. Moreover, the private sector is continually failing to meet its cybersecurity obligations. The result is what the world has witnessed over the last two to three weeks: the Binance hack, the most recent wave of cyberattacks against freezers in at least eight different European countries, the hacking of emergency alert apps in Ukraine and Russia, and large-scale data breaches against U.S. government departments, including the FBI, Pentagon, and Department of Homeland Security.

Adversaries across the world are emboldened right now. They aren’t going after random targets, but serious, high-profile ones that underline a palpable increase in their collective risk appetites. Most of all, these incidents point to the complacency of governments and industry in this AI-enabled era. If a $6 billion loss isn’t enough to prompt change in cybersecurity, then what is the tipping point?

As cryptocurrencies and digital assets continue to proliferate, the United States has the opportunity now to set global standards in protecting online transactions, working with partners and allies and coordinating stronger cross-border law enforcement activities. Furthermore, should U.S. investors become caught up in this incident and inevitable future ones, there needs to be stronger action taken against third-party enabling nations, especially China, whose laissez-faire approach empowers North Korean actors to launder funds into liquid assets and wholly benefit from evading sanctions.

Policymakers in the United States are hedging their bets on having a more innovative and open approach to cryptocurrencies and digital assets. However, absent any serious efforts to address the vulnerabilities in crypto exchanges and hold the industry accountable, it is only a matter of time before U.S. investors find themselves funding North Korea’s regime.

Taylar Rajic is a fellow in the Strategic Technologies Program at the Center for Strategic and International Studies (CSIS) in Washington, D.C. Nikita Shah is a senior fellow in the Intelligence, National Security, and Technology Program at CSIS.