If you trade crypto in South Africa, this one will get your attention. Binance, the biggest crypto exchange on the planet, has been hit by the largest crypto theft ever recorded. Investigators think a North Korean hacking unit did it. Here’s what we know so far, in plain language.
What Happened on 29 October
On 29 October 2026, hackers walked off with about $6.3 billion in digital assets. That figure didn’t come from outsiders. Binance gave the estimate itself in a post on X, and said it’s working with law enforcement and blockchain investigators.
TRM Labs, a blockchain analytics firm, tracked around $6.36 billion leaving wallets that the exchange controls. The money didn’t leave from one place. It moved across ten blockchains, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger.
Reports say withdrawals were frozen while the team dealt with the Binance hack. Imagine logging in to move your money and finding you can’t. That’s what many users faced.
Who Is Blamed
TRM Labs says it’s confident, “high confidence” in its words, that the attack came from TraderTraitor. This is a North Korean hacking unit that sits under the wider Lazarus Group. Chainalysis reportedly sees it the same way. Independent investigator ZachXBT called the attacker “likely Lazarus”.
But hold on. Binance hasn’t named anyone. No government has confirmed it either. Right now the finger pointing comes from private security firms, not from official findings.
Some experts also raised a fair doubt. Lazarus usually moves stolen money much faster than this attacker has. So the story could still shift.
Why Investigators Point to Pyongyang
TRM says the attack looks a lot like earlier heists tied to North Korea. The best known is the Bybit theft of about $1.5 billion in February 2025. The FBI linked that one to TraderTraitor, and you can read the agency’s notice on the FBI’s Internet Crime Complaint Center site. The new Binance hack is around four times larger.
Timing adds to the suspicion. Just two days before the theft, Binance said it had stopped North Korea linked attacks that used fake job interviews. The trick is simple. Someone pretends to offer you a job, then gets you to run harmful code. Early reports suggest a compromised laptop may have played a role here, but nothing is settled yet.
Key Facts at a Glance
Numbers are easier to follow in a table, so here are the basics.
| Detail | What is known |
|---|---|
| Date | 29 October 2026 |
| Amount stolen | About $6.3 billion, per Binance |
| Spread across | Ten blockchains |
| Suspected group | TraderTraitor, part of Lazarus (per TRM Labs) |
| Frozen so far | About $3 billion, per Binance |
| Customer losses | Binance says it will cover them |
Money Frozen and Customers Protected
There’s a bit of good news. Binance says roughly $3 billion of the stolen funds has been frozen. Tether and Circle, the companies behind two big stablecoins, reportedly froze about $2.4 billion of that. Stablecoins are easy to lock because their issuers can step in. That makes life harder for thieves trying to cash out.
The exchange has also promised to cover all customer losses. It plans to pay from its SAFU emergency fund and its own money. It adds that it found no sign that wallet private keys were leaked.
Next, Binance says it will publish an updated Proof of Reserves and a technical report. Those should show what it holds and how the attack worked. It makes sense to wait for those papers before deciding how safe the platform really is.
How the Market Reacted
Markets didn’t take the news calmly. Reports say Bitcoin slid to about $76,460, and around $1.53 billion in leveraged trades were wiped out. Those are bets placed with borrowed money, and they get closed fast when prices fall.
If you checked the bitcoin price usd during that drop, you saw how jumpy things got. Crypto often swings hard on big news. It can recover quickly too, but nobody can promise that.
So if you keep an eye on the bitcoin price usd every day, try not to act on fear. Panic selling has burned plenty of people before.
What This Means for South Africans
Lots of South Africans use global exchanges alongside local ones. If you’ve got money on Binance, keep a close watch on official updates. The company says customers will be repaid, but delays or limits on withdrawals could still happen.
A few simple habits can help. Only use the real Binance website or app, because scammers love big news and will send fake “refund” messages. Don’t keep all your coins on one exchange. A personal hardware wallet is another easy way to cut exchange risk, although then you’re fully responsible for your own keys. And switch on two factor login if you haven’t already. Never share your codes with anyone.
South Africa’s financial regulator also warns people about crypto scams and unlicensed operators. You can check the Financial Sector Conduct Authority website if an offer feels too good to be true. Usually, it is.
Why This Hack Matters
Crypto thefts aren’t new. But this one is on another level. The Bybit theft was once the record, and now it looks small next to this. If North Korea is confirmed as the attacker, it will add to worries that state backed hackers are going after the biggest exchanges.
It also shows that even giant platforms can be breached. Good systems still rely on people, and attackers know it. That’s why they target staff with things like fake job offers. The lesson applies to all of us. Be careful with unexpected messages, files and links.
What to Watch Next
Several things will shape the story over the coming days. Will Binance or any government formally name the attacker? Can more of the stolen money be frozen or recovered? Will the Proof of Reserves report show the exchange can truly cover its debts? And will withdrawals go back to normal?
Keep in mind that this story is still developing. Details may change as investigators dig deeper. Stick to official statements from Binance and trusted security firms, and be careful with rumours on social media.
The Bottom Line
The Binance hack is the biggest crypto theft on record. About $6.3 billion was taken, and investigators suspect North Korea’s TraderTraitor unit. Around $3 billion has been frozen, and Binance says it will make customers whole.
Still, trust has to be earned and checked. South African crypto users should stay calm, protect their accounts and follow verified updates. A few easy habits, like strong passwords, spreading your holdings and ignoring suspicious links, go a long way.
About the Author
