North Korean hackers are suspected of carrying out the Binance hack that drained approximately $6.3 billion in cryptocurrency from the world’s largest crypto exchange. Blockchain security researchers say the October 29 attack is the largest recorded cryptocurrency theft.
Investigators estimate that nearly half the stolen assets have been frozen. Binance is working with law enforcement and blockchain companies to recover additional funds. The full extent of the breach remains under investigation.
The attack follows Binance’s initial disclosure of suspicious withdrawals and its decision to suspend transfers while investigating the security incident.
Binance Hack Linked to Compromised Employee Laptop
In its initial statement on X, Binance said a compromised DevOps engineer’s laptop may have given the attacker access to its systems. The attacker allegedly entered a service container and submitted unauthorized withdrawal transactions.
Binance later said investigators had identified additional points of breach, indicating a more complex attack. The exchange found no evidence that its wallet private keys were stolen. It has not established the complete sequence of events.
The company suspended deposits and withdrawals as a precaution. It subsequently said deposits were operating normally while withdrawal security checks continued.
Binance maintains that customer funds are safe and has promised to cover losses through its Secure Asset Fund for Users and company resources. It also plans to publish an updated proof of reserves and a technical report after completing its investigation.
Researchers Attribute $6.3B Theft to North Korean Hackers
Blockchain intelligence company TRM Labs attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group. Its analysis found that approximately $6.36 billion moved from Binance wallets across multiple blockchains, mostly within 20 minutes.
TraderTraitor was previously linked to the February 2025 Bybit breach, which resulted in approximately $1.5 billion in stolen cryptocurrency. U.S. authorities attributed that attack to North Korean hackers.
Blockchain security firm Elliptic also linked the theft to North Korean actors. Its researchers traced some stolen funds to an address previously associated with the September 2026 Bitget attack.
That earlier incident involved the suspected theft of $351 million from Bitget. Investigators identified similarities between the attacks, although no government has publicly confirmed responsibility for the Binance breach.
Nearly $3 Billion Frozen as Recovery Efforts Continue
Binance says industry partners have frozen approximately $3 billion in affected assets. Stablecoin issuers, including Tether and Circle, helped restrict access to cryptocurrency linked to the attack.
Elliptic independently identified approximately $2.84 billion in frozen assets during its October 30 analysis. Researchers said attackers were converting other stolen tokens into cryptocurrencies that issuers cannot freeze directly.
The exchange is coordinating with law enforcement, blockchain investigators and industry partners to trace remaining funds. Frozen assets are not necessarily recovered, and the final amount returned remains uncertain.
The incident raises questions about security controls governing high-value cryptocurrency transactions. Investigators must determine how attackers gained sufficient access to authorize withdrawals without obtaining wallet private keys.
North Korean hacking operations have repeatedly targeted cryptocurrency businesses. U.S. officials have linked the country’s digital asset thefts to efforts to finance its sanctioned weapons programs.
Binance has promised further disclosures once its investigation is complete. For now, the precise attack method, final losses and prospects for recovering the remaining funds remain unresolved.
