North Korean Hacking Group Linked to $6.3bn Binance Cryptocurrency Theft
Blockchain intelligence investigators have linked a cryptocurrency theft estimated at $6.36 billion from Binance, the world’s largest cryptocurrency exchange, to a North Korean hacking unit known as TraderTraitor.
The attack, which occurred on Thursday, October 29, involved unauthorised transfers from Binance-controlled wallets across 10 blockchain networks, according to an investigation published by blockchain intelligence firm TRM Labs.
The firm said most of the funds were moved within approximately 20 minutes, making the incident one of the largest cryptocurrency thefts recorded.
TRM attributed the operation to TraderTraitor, a hacking group associated with North Korea, based on what it described as strong on-chain and off-chain intelligence.
The attribution has not been independently confirmed by law enforcement or officially acknowledged by Binance.
In its preliminary investigation, Binance said the incident might have originated from a compromised laptop belonging to a DevOps engineer.
The exchange explained that the suspected compromise allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
Binance said it had found no evidence that wallet private keys were leaked.
Billions moved across cryptocurrency networks
TRM’s investigation traced the transfers across 10 blockchain networks, including Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.
The firm estimated the value of the transferred assets at approximately $6.36 billion at the time of the transactions.
Its analysis indicated that the attackers used different transaction methods across the affected networks, including a technique that enabled them to redirect the behaviour of an Ethereum hot wallet through pre-signed authorisations.
A hot wallet is an internet-connected cryptocurrency wallet used by exchanges to process transactions and withdrawals.
TRM said the attackers appeared to have obtained the ability to generate valid transaction signatures across several Binance wallets, raising concerns about the security of the exchange’s internal signing infrastructure.
The firm said preparations for the attack had begun at least 36 hours before the major transfers.
About $3bn in assets frozen
Binance said it had worked with blockchain partners to freeze approximately $3 billion in affected assets.
TRM’s subsequent analysis estimated that around $2.7 billion had been frozen on-chain through the intervention of stablecoin issuers and other blockchain participants.
These included Tether, Circle and Ripple, which froze some assets linked to the attackers.
The Arbitrum network’s Security Council also took emergency action to move cryptocurrency assets out of an attacker-controlled wallet.
Despite the interventions, TRM estimated that the attackers still controlled approximately $2.4 billion in assets, including more than 420,000 ETH and 18,270 Bitcoin.
The remaining funds present a different recovery challenge because some cryptocurrencies, particularly Bitcoin, cannot be frozen directly by a central issuer. Their movement can instead be monitored and potentially restricted when they reach cooperating exchanges or other service providers.
Binance promises to cover losses
Following the incident, Binance temporarily suspended deposits and withdrawals while carrying out security checks.
The exchange subsequently said deposits were operating normally, although withdrawals remained suspended during its security overhaul.
Binance pledged to cover all losses arising from the incident using its Secure Asset Fund for Users, known as SAFU, and company funds.
It also promised to publish an updated Proof of Reserves after completing its remediation process.
The company said it would release a detailed technical post-mortem once its investigation had been completed and the findings fully verified.
North Korean hacking operations under scrutiny
TraderTraitor has previously been associated with major cryptocurrency thefts attributed to North Korean-linked cybercriminals.
TRM compared the techniques used in the Binance incident with methods observed in previous attacks, including the February 2025 theft of approximately $1.5 billion from cryptocurrency exchange Bybit.
The firm’s attribution is based on similarities in the attackers’ preparation, transaction patterns and subsequent movement of stolen assets.
However, the identities of the individuals responsible for the Binance incident have not been publicly established in the material examined for this report.
The investigation remains ongoing as Binance and its industry partners work to trace the remaining assets, strengthen security systems and establish the full circumstances surrounding the breach.
