Binance Hack Bears Hallmarks Of North Korean Unit

Binance wallets lost about $6.3 billion on Oct. 29 in the largest recorded cryptocurrency theft, according to blockchain intelligence firms that linked the attack with high confidence to North Korea’s TraderTraitor hacking unit.

TRM Labs tracked the transfers across 10 blockchains and estimated that about $6.36 billion left Binance wallets. Most of the funds moved within roughly 20 minutes. The amount exceeds the $1.5 billion stolen from Bybit in February 2025, previously the largest known crypto theft.

Binance halted withdrawals and pledged to reimburse customers with company funds and its Secure Asset Fund for Users, known as SAFU. The exchange’s preliminary investigation indicated that the attack may have started with a compromised laptop belonging to a DevOps engineer. Binance found no evidence that wallet private keys had been exposed.

The attacker allegedly used access to a service container to submit unauthorized withdrawal transactions. TRM’s analysis found that the hackers spent at least 1½ days preparing the operation. They funded an operator wallet with several small withdrawals from Tornado Cash and tested malicious code on other wallets before the attack.

On Ethereum, the attackers used EIP-7702, a feature that allows a standard crypto wallet to delegate some functions to a smart contract after the owner signs a permission. They sent 50 pre-signed permissions, increasing the chance that one would match the Binance wallet’s transaction count when executed. The wallet was then linked to a contract controlled by the attackers, who used it to transfer the funds.

The Ethereum transfers initially appeared consistent with phishing. TRM found that explanation did not account for activity on the other nine blockchains, where Binance wallets sent funds through valid, signed transactions. The wallets used different chains, key types and signing methods, yet produced valid signatures for the attackers within about 30 minutes.

TRM’s assessment is that the attacker gained the ability to make Binance’s hot-wallet signing system approve transactions of the attacker’s choice across multiple blockchains.

TRM linked the attack to TraderTraitor based on on-chain and other intelligence. The firm identified similarities with the Bybit theft and the April 2026 KelpDAO hack, including an operator wallet funded through a mixer, extended preparation periods and signatures collected before the funds were moved. Chainalysis reached the same preliminary conclusion and cited links to an earlier hack. Blockchain investigator ZachXBT identified the Lazarus Group as the likely attacker. The FBI previously attributed the Bybit theft to TraderTraitor.

The hackers have mainly used large trades with market makers and lending platforms to launder the Binance proceeds, rather than relying primarily on cross-chain bridges. Binance has not publicly identified those responsible and is cooperating with law enforcement.

By 00:30 UTC on Oct. 30, TRM had identified about $2.7 billion in frozen assets. The total included roughly $1.77 billion in USDT frozen by Tether and $825 million in USDC frozen by Circle. Ripple and World Liberty Financial froze smaller amounts. Arbitrum’s Security Council used emergency powers to move about $30 million from an attacker-controlled wallet. Binance estimated that about $3 billion had been frozen.

The attackers sold USDT for Ether at discounts of more than 10% below market prices, apparently seeking to convert the funds before issuers could block them. TRM estimated that the hackers still controlled more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion. Stablecoin issuers cannot freeze those assets.