North Korean hackers blamed for $6.3bn Binance crypto theft
North Korean state-backed hackers may be responsible for the $6.3bn security breach at cryptocurrency exchange Binance, according to blockchain intelligence firm TRM Labs, which linked the attack to the hacking group TraderTraitor.
The firm said it had high confidence in its assessment after examining transactions across 10 blockchains and comparing them with previous attacks attributed to North Korean hackers.
An online perpetrator transferred approximately $6.36bn from Binance wallets on 29 October, moving most of the assets within just 20 minutes.
How investigators linked the attack to North Korea
TRM Labs identified several similarities between the Binance breach and previous attacks associated with TraderTraitor, including preparations made days before the theft, advance authorisation of transactions and the rapid movement of funds.
The attackers allegedly gained control over Binance’s transaction-signing infrastructure, allowing them to transfer assets from wallets operating across different blockchains.
Binance’s preliminary investigation offers another possible explanation for the initial intrusion. The exchange said an attacker may have compromised a DevOps engineer’s laptop, gained access to an internal service container and submitted unauthorised withdrawal transactions.
The exchange estimates the financial impact at approximately $6.3bn, with around $3bn in affected assets frozen through cooperation with blockchain partners.
TRM Labs independently identified approximately $2.7bn in frozen assets, while the attackers still controlled more than 420,000 ether and 18,270 bitcoin, worth roughly $2.4bn at the time of its analysis.
North Korea’s biggest cryptocurrency thefts
North Korean hacking groups have previously been linked to several major cryptocurrency thefts, with US authorities accusing them of using stolen digital assets to generate revenue for the country.
- The largest confirmed case before Binance was the February 2025 Bybit hack, when attackers stole approximately $1.5bn in cryptocurrency.
- Another high-profile incident occurred in March 2022, when attackers stole approximately $620mn from the Ronin blockchain network, which supported the popular game Axie Infinity. The FBI identified North Korea’s Lazarus Group and APT38 as responsible.
- TraderTraitor was also linked to the $308 million theft from Japanese exchange DMM Bitcoin in May 2024. According to the FBI, an attacker posing as a recruiter tricked an employee of a cryptocurrency wallet software provider into running malicious code, helping the hackers gain access to systems involved in processing transactions.
Read more: When will Revolut and other apps work again after Google Cloud outage?
Blockchain analysis company Chainalysis estimates that North Korean hackers stole $2.02bn in cryptocurrency throughout 2025, bringing their cumulative known thefts to approximately $6.75bn by the end of that year.
