NEWS

Binance $6.3 Billion Hack Linked to North Korea's TraderTraitor

Binance says a compromised DevOps laptop led to about $6.3B in unauthorized withdrawals. TRM Labs and Chainalysis point to TraderTraitor; ~$3B is frozen.

Dylan H.

News Desk

October 30, 2026
3 min read
Binance $6.3 Billion Hack Linked to North Korea's TraderTraitor

Summary

Binance has confirmed a security incident affecting roughly $6.3 billion in assets, which would make it the largest cryptocurrency theft on record. Blockchain analysts at TRM Labs and Chainalysis attribute the attack, with high confidence, to North Korea's TraderTraitor group, the same cluster tied to the $1.5 billion Bybit theft in February 2025.

What We Know

  • TRM Labs says funds left Binance-linked wallets across ten blockchains on October 29, with most transfers completed in about 20 minutes. It puts the theft at about $6.36 billion.
  • Binance's initial findings point to a compromised DevOps engineer's laptop, which let the attacker reach a service container and submit unauthorized withdrawals.
  • Nearly $3 billion has been frozen on-chain. Tether froze more than 1.567 billion USDT and Circle froze 800 million USDC; the Arbitrum Security Council reportedly froze about $30.5 million.
  • Binance temporarily suspended deposits and withdrawals while it runs security checks and works with law enforcement.
  • The exchange says it will cover all losses using its SAFU fund and company funds. Forbes estimates SAFU at roughly $1.17 billion, a fraction of the total.

Earlier reports on October 29 put the exposure at up to $5.8 billion; the figure was revised upward as the investigation progressed.

Why It Matters

The reported entry point mirrors earlier DPRK operations: compromise a single privileged engineer's endpoint, then abuse internal infrastructure to approve withdrawals rather than attacking blockchain protocols directly. Freezing assets on-chain does not return them to Binance, and laundering of the unfrozen portion is expected to follow established DPRK patterns.

Recommendations

  1. Treat privileged DevOps and signing-adjacent workstations as tier-0 assets: hardware-backed MFA, application allowlisting, and no general browsing or personal use.
  2. Require multi-party approval and out-of-band verification for high-value withdrawals or transfers originating from service accounts.
  3. Monitor service containers that can initiate financial operations for anomalous API calls and new egress.
  4. Block and report interactions with addresses identified by TRM Labs and Chainalysis as they publish indicators.
  5. Exchange customers should enable withdrawal allowlists and anti-phishing codes, as impersonation scams commonly follow incidents of this scale.

Sources