North Korean Hackers Linked to Record $6.36 Billion Binance Theft, TRM Labs Says

TRM Labs says North Korean hackers stole approximately $6.36 billion from Binance in what the blockchain intelligence firm describes as the largest cryptocurrency theft on record, attributing the attack to its TraderTraitor cyber unit.

The attackers moved funds across 10 blockchains, with most of the transfers completed in approximately 20 minutes on October 29.

TRM Labs attributed the operation to TraderTraitor, a North Korean hacking unit associated with the broader Lazarus Group, with high confidence.

Binance has confirmed a security incident affecting approximately $6.3 billion and said it will cover customer losses.

No government authority had publicly confirmed the attribution at the time of publication.

Clash Report first reported on October 29 that Binance co-founder Changpeng Zhao said the exchange appeared to have been hacked as Tether and Circle froze nearly $1.8 billion.

$6.36 Billion Drained in Approximately 20 Minutes

According to TRM Labs, the attack began at approximately 20:05 UTC on October 29.

The attackers rapidly transferred cryptocurrency from Binance-controlled wallets across 10 blockchain networks.

Most of the approximately $6.36 billion in reported outflows occurred within about 20 minutes.

TRM said the speed and scale of the transfers indicate that the attackers could make Binance’s systems authorize movements from multiple exchange wallets.

TRM described the incident as the largest cryptocurrency theft ever recorded.

The amount is about four times the roughly $1.5 billion stolen in the February 2025 Bybit attack.

TRM Labs Identifies North Korean TraderTraitor Group

TRM Labs attributed the attack to TraderTraitor, an elite North Korean hacking operation linked to the Lazarus Group.

The firm said its assessment was based on a combination of on-chain and off-chain intelligence.

It assigned high confidence to the attribution.

Other blockchain intelligence companies have also pointed to North Korea. Chainalysis CEO Jonathan Levin said the firm assessed that the hack was likely carried out by TraderTraitor, citing links to a previous attack.

However, no official government attribution has been publicly announced.

The findings therefore represent assessments by private cybersecurity and blockchain intelligence firms rather than a confirmed government determination.

Attackers Exploited Binance Wallet Signing Systems

TRM’s technical analysis indicates that the attackers compromised infrastructure used to authorize transactions from Binance hot wallets.

On Ethereum, the operation involved an EIP-7702 delegation.

The attackers used the mechanism to turn a Binance hot wallet into a controlled asset-sweeping account.

According to TRM, the activity involved 50 pre-signed authorizations that allowed the attackers to execute transactions through the compromised wallet.

On other blockchains, assets were transferred through conventional signed transactions.

The different transaction methods pointed to a broader compromise of Binance’s wallet-signing infrastructure rather than an isolated vulnerability affecting a single blockchain.

The precise sequence through which the attackers obtained the necessary signing access remains under investigation.

Binance Investigates Compromised Engineer’s Laptop

Binance has confirmed the security incident and estimated its financial impact at approximately $6.3 billion.

The exchange has suspended withdrawals on affected blockchain networks while its investigation continues, and says it expects to resume withdrawals within 48 hours.

According to its preliminary findings, a compromised engineer’s laptop may have provided the attackers with an initial entry point.

That assessment has not yet been established as the definitive cause.

Investigators are examining how the attackers gained access to the systems responsible for authorizing transactions.

Binance has said it will cover losses resulting from the incident.

The exchange has not yet provided a final technical account of the breach.

Billions Frozen, but Attackers Retain Bitcoin and Ether

Stablecoin issuers and blockchain security authorities have moved to restrict access to part of the stolen assets.

TRM Labs reported that approximately $2.7 billion had been frozen through actions involving Tether, Circle, Ripple, World Liberty Financial and other parties.

The response also included freezes carried out through Arbitrum’s Security Council.

Binance has separately indicated that approximately $3 billion in assets have been frozen.

The figures reflect different reported assessments and have not been fully reconciled.

Despite those measures, TRM said the attackers still control more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion.

Unlike assets subject to centralized issuer controls or specific network intervention mechanisms, those holdings cannot be frozen through the same procedures.

The amount ultimately recoverable remains uncertain.

Record Theft Exceeds Previous Crypto Attacks

The estimated $6.36 billion theft represents a substantial increase over previous cryptocurrency security incidents.

TRM compared the attack with the February 2025 breach of Bybit, which resulted in approximately $1.5 billion in losses.

The Binance incident involved a much larger amount and affected wallets across 10 separate blockchains.

Its reported use of compromised signing infrastructure also raises questions about the security of systems responsible for authorizing exchange transactions.

The investigation remains focused on the initial intrusion, the movement of stolen funds and the extent of the assets that can be recovered.

North Korean Attribution Awaits Official Confirmation

North Korean cyber operations have previously been linked to large-scale cryptocurrency thefts used to generate revenue.

TRM’s attribution places the Binance attack within that established pattern.

However, the firm’s high-confidence assessment does not constitute official confirmation by a government authority.

Binance has acknowledged the scale of the incident, suspended withdrawals on affected networks and committed to covering customer losses.

With billions of dollars frozen and substantial cryptocurrency holdings still controlled by the attackers, the final financial impact remains unresolved.