Unspent Thoughts

North Korea's TraderTraitor likely behind the $6.3 billion Binance hack

BITCOIN · score 8/10 · 2026-10-30

Binance lost roughly $6.3 billion to hackers on Thursday, and the firms that trace stolen crypto for a living say North Korea is probably responsible.

TRM Labs attributed the attack to TraderTraitor, a sub‑unit of the Lazarus Group, with high confidence. According to TRM, the attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in roughly 20 minutes. That would make it the largest cryptocurrency theft on record, surpassing the $1.46 billion Bybit hack of February 2025, which the FBI also linked to North Korea.

The evidence

The attribution is coming from several directions at once. ZachXBT found that funds stolen from Binance and from the earlier Bitget exploit converged at the same address after moving through THORChain. "This indicates the same actor is likely behind both incidents," he said, and the Bitget attack had already been attributed to TraderTraitor.

Chainalysis CEO Jonathan Levin put the number slightly higher, at $6.4 billion, citing "links to previous hack."

Blockaid CEO Ido Ben‑Natan said the tactics and sophistication match DPRK operations, noting that DPRK‑linked actors have been tied to the Kelp DAO, Bitget, and Drift incidents this year.

A person familiar with crypto investigations told CoinDesk there are "very few actors who could pull something like this off," but cautioned that the attribution is not definitive yet. Lazarus crews are usually faster and more efficient at moving and selling stolen funds than Thursday's hackers were.

What Binance is saying

Binance says it worked with blockchain partners to freeze roughly $3 billion in affected assets and has started recovering funds for users. Deposits were unaffected; withdrawals are suspended and are expected to resume within a day or two. The company also said it will cover all losses.

The breach itself is still murky. Binance first suggested a compromised laptop, then said a follow‑up investigation uncovered additional "points of breach." It also said it found "no evidence of any wallet private key leak."

Kok Tin Gan, CEO of cybersecurity firm NyxLab, offered a blunt read: "This looks like one signature that gave the attacker a never‑expiring, full‑access token to a Binance hot wallet."

The pattern

The TraderTraitor playbook is well documented. The FBI says the group targets company employees through social engineering. In the May 2024 DMM Bitcoin theft (over $300 million), an attacker posing as a recruiter sent a malicious coding test to an employee of wallet provider Ginco, allowing the attacker to manipulate a legitimate transaction request.

Changpeng Zhao, who founded Binance in 2017, posted on X that "User funds are safe!" while acknowledging the incident "does look like a hack on Binance." He added that, as a shareholder, he expects all user funds will be fully covered.

Two things stick with me. The freeze is genuinely new. In past mega‑hacks the money was gone before anyone finished the press release, and this time roughly half the haul got locked down. The tracing and coordination plumbing works, at least sometimes. But the entry point never changes - it is not some brilliant cryptographic break. It is a compromised laptop, or a fake recruiter with a coding test.

South Korea's spy agency said back in 2022 that North Korea's ability to steal digital assets was among the best in the world, estimating $1.1 billion stolen over five years.

Whether the attribution holds, and whether the $6.3 billion in covered losses actually gets covered, are questions nobody can answer yet.

Sources

Sources