Business · World News Bureau

Binance's record heist: is the North Korean spy romance real?

A post claiming a Binance engineer fell for a North Korean spy has drawn more than 675,000 views. The FBI does blame North Korea for the $6bn-plus theft. The romance is unverified, denied by Binance, and the free 'compensation' that followed is a scam.

LSN World News · 2 November 2026

Binance's record heist: is the North Korean spy romance real?

<p><em>Special Reporting from LSN News, adapted from today's Asia Behind the Headlines episode. <a href="https://youtu.be/Q2XlBjScTuw" target="_blank" rel="noopener">Watch the video on YouTube.</a></em></p>

<p>Six hundred and seventy-five thousand views. That is how far one post on X had travelled by Monday morning with a dramatic claim: that a Binance engineer was romantically involved with a North Korean spy before the biggest cryptocurrency theft on record. The post, published on 1 November, labelled its own story "new, unverified allegations" and said the claims were being attributed online to the on-chain investigator ZachXBT, though his original statement "has not been independently verified".</p>

<p>Hours later, Binance co-founder Yi He replied directly. Writing in Chinese, she said the story was more dramatic but not true, and that ZachXBT had never said it. None of the major outlets covering the hack that LSN reviewed, including the BBC, CNBC and DW, has reported any such relationship.</p>

<h2>What is confirmed</h2>

<p>The theft itself is real, and historic. On 31 October the FBI said North Korea "was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026." The bureau attributed the attack to a North Korean operation it calls TraderTraitor, the same actors behind the $1.5bn hack of the Bybit exchange in 2025. The Associated Press called it the biggest crypto heist in history. Blockchain intelligence firm TRM Labs had earlier put the loss at about $6.36bn.</p>

<p>The stolen assets included bitcoin, ether and stablecoins such as tether and USD Coin. The FBI said the hackers were converting them mainly into ether, and published hundreds of wallet addresses it asked exchanges and decentralised finance services to block. Stablecoin issuers froze more than $2.4bn of the stolen funds, according to CoinDesk, and the US Secret Service said investigators had worked with industry partners within minutes "to identify and freeze a significant portion of stolen cryptocurrency".</p>

<p>How did the attackers get in? Binance has said early checks suggest the incident may have started with a compromised laptop belonging to an engineer. Beyond that preliminary finding, nothing about the engineer has been confirmed.</p>

<h2>The second wave: fake payouts</h2>

<p>When Binance began reopening withdrawals in phases on Sunday, 1 November, a new set of posts appeared. Some promised users a free $150 payment as compensation for the pause. Binance told one user that a screenshot advertising such a payment had been digitally manipulated, and Korean outlet DigitalToday reported that scam accounts were spreading the $150 offer.</p>

<p>Yi He's warning was blunt: "There is currently no cash voucher campaign, so please be vigilant against all types of phishing and scam links." She said any official community rewards campaign would need regulatory approval first. She also flagged fake "official Binance announcements" sent through small token transfers on Telegram, urging users to move their assets into a so-called Binance vault. Interim chief marketing officer Eowyn Chen said there was no separate compensation for the withdrawal suspension.</p>

<h2>The numbers that matter</h2>

<p>Binance says it has replaced around 95% of the stolen assets, using its corporate treasury, futures insurance and emergency reserve funds, and that the remaining 5% are less liquid tokens that will take longer to source. "Binance will fully cover the financial impact of the funds stolen in this incident," the company said.</p>

<p>Between 06:00 and 15:30 UTC on 1 November, Binance said it processed $4.649bn in withdrawals and $1.01bn in deposits, a net outflow of about $3.64bn. It put that at 2.1% of its $171bn in assets under management, based on proof-of-reserves data from 28 October. Founder Changpeng Zhao summed it up on X as "98% choose to stay!", a figure that refers to assets, not to the number of users.</p>

<p>The laundering is far from over. Chainalysis chief executive Jonathan Levin said he expects the attackers to use "tens of thousands" of addresses in the coming weeks, an expectation rather than a finding.</p>

<p>Our read: the heist is real and historic, and the evidence points firmly to North Korea. But the viral spy romance is unconfirmed gossip, and the free money now circulating is the newest trap. After a hack of this size, the next theft usually starts with a link. Check the exchange's official accounts before you click anything.</p>

<h2>Sources</h2>

<ul>

<li><a href="https://x.com/AlphaWireHQ/status/2116893978620555520" target="_blank" rel="noopener">AlphaWire on X, 1 Nov 2026</a></li>

<li><a href="https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack" target="_blank" rel="noopener">FBI cyber alert, 31 Oct 2026</a></li>

<li><a href="https://www.koreaherald.com/article/10921526" target="_blank" rel="noopener">The Korea Herald, Nov 2026</a></li>

<li><a href="https://www.digitaltoday.co.kr/en/view/122347/binance-warns-of-fake-compensation-campaigns-as-withdrawals-resume" target="_blank" rel="noopener">DigitalToday, 2 Nov 2026</a></li>

<li><a href="https://econotimes.com/Binance-Says-150-Compensation-Claim-Used-a-Manipulated-Screenshot-1768073" target="_blank" rel="noopener">EconoTimes, 1 Nov 2026</a></li>

<li><a href="https://x.com/binance/status/2116926305254133892" target="_blank" rel="noopener">Binance on X, 1 Nov 2026</a></li>

<li><a href="https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses" target="_blank" rel="noopener">CoinDesk, 31 Oct 2026</a></li>

<li><a href="https://x.com/SecretService/status/2116956218887389218" target="_blank" rel="noopener">U.S. Secret Service on X, 1 Nov 2026</a></li>

<li><a href="https://x.com/cz_binance/status/2116954044988354798" target="_blank" rel="noopener">Changpeng Zhao on X, 1 Nov 2026</a></li>

</ul>