North Korean hackers were behind the $6.3 billion Binance crypto theft, US blockchain analysis firm TRM Labs said on October 30. They attributed the attack to TraderTraitor, North Korea’s elite hacking unit.
In the same window, Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers,” they noted. We make this judgment with high confidence. Binance, in its latest statement , had noted that the hack likely involved a “compromised DevOps engineer’s laptop. “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. TRM explained how the North Korean hackers allegedly stole cryptocurrency from Binance. They added that this pointed to a compromise in Binance’s hot wallet signing infrastructure. The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. The same group has been blamed for the Bybit hack as well. The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit.”
This is the largest crypto theft on record, with the $1.5 billion stolen in the Bybit hack in February 2025, coming in second place. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified,” they said, adding that $3 billion had been frozen thus far. “On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorizations prepared in advance. “Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion. It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer’s reach,” TRM further explained about the hack and subsequent fund freezing. The US Blockchain analysis firm noted there were similarities with the April 2026 KelpDAO hack as well.
In a blog post , TRM said, “An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes,” adding, “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. The company promised to “cover all losses” from the SAFU fund and the company’s funds and noted that it was working with law enforcement to “confirm the identity of these criminals and bring them to justice.
TRM attributed the hack to North Korea noting “several features of this attack match earlier North Korea-linked heists. The firm explained there were “small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst.
