‘Dramatic but not true: Binance denies North Korean honey trap was behind after $6.3bn hack
Binance co-CEO Yi He has rejected claims that the romance between a company engineer and a North Korean spy enabled the exchange’s $6.3bn hack. Her denial followed remarks by US president Donald Trump, who said Washington would discuss the theft with Pyongyang if it was responsible.
«We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it,» Trump told the media on 31 October.
The following day, AlphaWire claimed on X that a Binance DevOps engineer had been romantically involved with a North Korean operative and left a laptop unattended on the day of the hack.
Its post labelled the allegations as unverified and attributed them to blockchain investigator ZachXBT without linking to supporting evidence.
🚨 BREAKING: BINANCE ENGINEER HAD ROMANTIC RELATIONSHIP WITH NORTH KOREAN SPY BEFORE $6.3B HACK New, unverified allegations claim that a Binance DevOps engineer was romantically involved with a North Korean operative and left their laptop unattended on the day of the attack. The hack has previously been linked to a compromised engineer’s laptop, while North Korean hackers have been implicated in the wider breach. The romantic relationship and unattended-laptop claims are being attributed to ZachXBT online, but his original statement has not been independently verified.
— AlphaWire (@AlphaWireHQ) November 1, 2026
Yi He responded in Chinese, insisting that ‘This story is more dramatic, but it is not true. ZachXBT did not say that’.
Read more: One hacked laptop may be behind Binance’s $6.3bn security breach
Was it a money trail or a romance?
ZachXBT’s findings traced stolen cryptocurrency down to an earlier $388-million Bitget exploit that had reached the same address through THORChain, suggesting the same attacker was behind both.
The blogger noted that the Bitget attack had been attributed to North Korea-linked TraderTraitor. His post made no claim about an employee’s relationship or an unattended laptop.
Binance’s preliminary investigation suggested that a compromised engineer’s laptop may have enabled the unauthorised withdrawals. It did not establish how the device was compromised or support the relationship allegation.
Previously, the FBI has attributed more than $6 billion in stolen assets to North Korea and described efforts to launder the proceeds. It contained no allegation of a romance.
