On October 29, 2026, more than $6.3 billion left Binance in about twenty minutes, the largest theft ever recorded. Our video documentary and its full transcript reconstruct the heist minute by minute, from a fake recruiter to the race to freeze the money.

This article is the written version of our video documentary on the Introvert Investor YouTube channel. Watch it above or read the full story below.

On October 29, 2026, one of Binance's hot wallets held $1.6 billion in a single stablecoin. At 20:20 UTC, someone pressed enter. Three minutes and twenty-four seconds later, the wallet was empty.

And that was just one wallet. By the end of the night, more than $6.3 billion had left the world's biggest crypto exchange. It is the largest robbery in human history: bigger than any bank heist ever recorded and about four times bigger than the previous crypto record.

No guns. No tunnel. No masks. It started with a job interview.

Chapter 1: The Hunters

To understand this heist, you have to understand who was behind it. North Korea is one of the most sanctioned countries on Earth. It can't easily sell its goods, borrow money or use the global banking system. So it found another way to get dollars: it steals them.

United Nations investigators estimated that North Korean hackers stole around $3 billion in crypto between 2017 and 2023. American officials say that money helps fund the country's missile program.

The FBI tracks one unit in particular, which it calls TraderTraitor. Most people know it as part of the Lazarus Group. In February 2025, the same unit drained $1.5 billion from the exchange Bybit. It was the biggest crypto theft ever, until now.

Chapter 2: The Bait

The attack on Binance didn't begin in October. It began in June 2026.

A Binance engineer on the team that runs the company's crypto wallets was looking for an AI coding tool. The engineer downloaded what looked like a normal installer, but it had been tampered with.

Binance's security team caught it. They replaced the laptop and changed the passwords. Problem solved, or so it seemed. The attackers had already learned something priceless: who the engineer was, which team they worked on and who their colleagues were.

In September, one of those colleagues got a message from a recruiter. An exciting role, great money, would they like to interview? The interviews felt real. At the end came a small coding test, and hidden inside it was malware built to slip past security tools.

From there, the attackers moved quietly through Binance's internal systems, even its internal AI tools, until they reached the most valuable door in the building: the system that approves wallet transactions. Then they waited.

Chapter 3: The Heist

On October 28, the attackers' wallet received three small deposits from Tornado Cash, a mixer used to hide where money comes from. The next morning, they rehearsed with three test runs. Everything worked.

At 20:05 UTC on October 29, it began:

• Five Binance wallets on the XRP Ledger sent 233,460,000 XRP to one address.
• Then Solana, then Optimism.
• At 20:20, a Bitcoin wallet sent 18,270 BTC, almost $1.5 billion in a single transaction.

At the same moment, the attackers hit the crown jewel, Binance's main Ethereum wallet, with a clever trick: 50 pre-signed authorizations, each one matching a different position in the wallet's transaction count. Sooner or later, one had to fit. One did.

Three minutes and twenty-four seconds later, the wallet was empty: 167,464 ETH and $1.6 billion in Tether, gone. Within two minutes the attack moved to Tron, and later that night to Avalanche and Polygon. In total, ten blockchains and more than $6.3 billion.

Chapter 4: The Race

Now the race began. Not the thieves running from the police, but the money running from the freeze.

Bitcoin and ether can't be frozen by anyone. Stablecoins can, because the companies that issue them can lock tokens in place. Thirty-seven minutes after the main sweep, Tether froze $971 million. Three minutes later, Circle froze $823 million. Ripple and others followed.

The thieves ran. They dumped hundreds of millions in stablecoins for ether at a loss of more than 10%, just to get into money nobody could freeze.

By half past midnight, around $2.7 billion was frozen; Binance later put the figure at about $3 billion. That means roughly $3 billion got away.

Chapter 5: The Aftermath

Binance paused withdrawals for about two days, and Bitcoin fell around 4%. When withdrawals reopened, customers pulled out $4.7 billion.

Then came the surprise: Binance said it would cover the losses itself, not its users, from its emergency fund, insurance fund and treasury.

On October 31, the FBI made it official: North Korea, TraderTraitor. Pyongyang denied everything. Binance co-CEO Richard Teng later said the attackers spent months building their way in. It wasn't one careless click. It was a campaign.

Chapter 6: The Lesson

What does this mean for you? When you keep crypto on an exchange, you trust its security and its ability to pay you back if that security fails. This time, Binance could. Smaller platforms often can't. That is the idea behind the old saying "not your keys, not your coins". If you want to hold crypto yourself, see our overview of crypto wallets.

The weakest point was never the code. It was people: a download from the wrong place, a recruiter who wasn't a recruiter, a test that wasn't a test.

Somewhere, right now, 18,270 stolen bitcoin are still being split into smaller and smaller pieces, waiting to be turned back into money. The biggest robbery in history took twenty minutes. The search for the money may take years.

Key facts

• Date: October 29, 2026, starting 20:05 UTC
• Amount stolen: about $6.36 billion across 10 blockchains
• Attributed to: North Korea's TraderTraitor (Lazarus Group), per the FBI
• Entry point: a tampered AI coding-tool installer (June) and a fake recruiter's coding test (September)
• Frozen: about $3 billion in stablecoins; roughly $3 billion escaped
• Customers: losses covered by Binance

Sources: TRM Labs; CNBC (30 Oct, 31 Oct and 3 Nov 2026); FBI statement of 31 Oct 2026 as reported by Al Jazeera and The Record; Khaleej Times. Figures are as reported in early November 2026 and may be revised as the investigation continues. This article is for education only and is not financial advice.