Blockchain intelligence firms link North Korea to $6.3B hack on Binance
[October 30, 2026] A
U.S.-based blockchain intelligence firm says a North Korean unit was
likely behind the hack that impacted more than $6 billion on Binance,
the world’s biggest cryptocurrency exchange.
Binance said it worked with blockchain partners to freeze roughly $3
billion in affected assets.
The cryptocurrency exchange said Friday that deposits were unaffected,
while withdrawals have been suspended and are expected to resume in the
next day or two. It said it will cover all losses.
The company said on X Friday that an initial investigation suggested the
incident may have involved a compromised laptop, but that a subsequent
investigation uncovered additional “points of breach.”
TRM, in a post on its website Thursday, attributed the attack to
TraderTraitor, which it described as North Korea’s elite hacking unit.
“We make this judgment with high confidence,” the firm said.
“An attacker moved approximately USD 6.36 billion out of Binance wallets
on ten blockchains, most of it in about 20 minutes,” TRM said. That
would make the hack the largest cryptocurrency theft on record, it said.
In February last year, another cryptocurrency exchange, Bybit, suffered
a $1.5 billion hit when it was hacked. The FBI said North Korea and
TraderTraitor were responsible for the hack.
“Several features of this attack match earlier North Korea-linked
heists, including the Bybit hack,” TRM said.
Blockchain analysis company Chainalysis also believed the Binance hack
was “likely done by DPRK group TraderTraitor,” its co-founder and CEO
Jonathan Levin wrote on X. DPRK stands for the Democratic People’s
Republic of Korea, North Korea's official name.
Asked about the potential ties to North Korea, a Binance spokesperson
said only that the company is “working closely with our law enforcement
partners to confirm the identity of the criminals and bring them to
justice.”
[to top of second column] |
 Experts say North Korea has turned
to crypto hacking and other illicit cyber activities as a source of
badly needed foreign currency to support its troubled economy and
fund its nuclear program in the wake of tough U.N. sanctions and
other difficulties.
In December 2022, South Korea’s spy agency said North Korean hackers
had stolen an estimated 1.5 trillion won ($1.1 billion) in
cryptocurrency and other virtual assets in the past five years, more
than half of it in 2022 alone. It said North Korea’s capacity to
steal digital assets was considered among the best in the world.
Changpeng Zhao, also known as CZ, founded Binance in 2017. In 2023,
he pleaded guilty to a felony linked to failing to prevent money
laundering on the platform, and stepped down as the company's CEO.
U.S. President Donald Trump pardoned Zhao in 2025.
Zhao posted Thursday on X that “User funds are safe!” but added that
the theft “does look like a hack on Binance.” He added that while he
doesn’t manage Binance anymore, “as a shareholder, I expect all user
funds will be fully covered.”
The event, meanwhile, also raises questions about why stronger
approval controls were not in place, said Kok Tin Gan, cofounder and
CEO of cybersecurity firm NyxLab.
“This looks like one signature that gave the attacker a
never-expiring, full-access token to a Binance hot wallet,” he said,
referring to cryptocurrency wallets that hold users' “private keys,”
or unique authorizations, digitally and which are connected to the
internet.
Binance said on X it had “found no evidence of any wallet private
key leak” and that the company would release more technical details
when its probe is complete.
All contents © copyright 2026 Associated Press. All rights reserved
 |
