North Korean hackers were behind the $6.36 billion cryptocurrency theft from Binance, according to US-based blockchain intelligence firm TRM Labs. In a report published on October 30, the company attributed the attack to TraderTraitor, an elite hacking unit linked to North Korea, making it the largest cryptocurrency theft recorded to date.
According to TRM Labs, the attacker moved approximately $6.36 billion from Binance wallets across 10 different blockchain networks, with most of the transactions taking place within just 20 minutes. The firm said its attribution was based on extensive on-chain and off-chain intelligence and expressed high confidence in its assessment.
The scale of the theft surpasses the $1.5 billion cryptocurrency stolen from Dubai-based crypto exchange Bybit in February 2025, which was previously considered the largest crypto heist in history.
Binance has indicated that the incident may have originated from a compromised DevOps engineer’s laptop. However, the exchange has not yet released its complete technical investigation.
Credits: Al Jazeera
How Did North Korean Hackers Allegedly Steal $6.36 Billion?
TRM Labs explained that the attackers exploited Binance’s hot wallet infrastructure to execute unauthorised cryptocurrency transfers across multiple blockchain networks.
On the Ethereum network, the hackers allegedly used an EIP-7702 delegation mechanism to turn a Binance hot wallet into a sweeper wallet under their control. A sweeper wallet automatically collects and transfers cryptocurrency to another address.
According to the blockchain analysis firm, the attackers had prepared 50 pre-signed authorisations in advance, allowing them to execute transactions rapidly. Meanwhile, Binance wallets operating across nine other blockchain networks transferred funds to attacker-controlled addresses through conventional signed transactions.
The coordinated activity across 10 networks points towards a possible compromise of Binance’s hot wallet signing infrastructure, which is responsible for authorising cryptocurrency withdrawals.
Binance’s initial investigation suggested that a compromised DevOps engineer’s laptop may have provided the attackers with access to a service container, enabling them to submit unauthorised withdrawal transactions.
The exchange, however, said it had found no evidence of cryptocurrency wallet private keys being leaked. It also promised to cover all customer losses through its Secure Asset Fund for Users (SAFU) and company funds.
$2.7 Billion In Cryptocurrency Frozen After The Attack
Following the theft, several cryptocurrency companies and blockchain networks moved to freeze assets associated with the attackers.
According to TRM Labs, Tether, Circle, Ripple and World Liberty Financial collectively froze approximately $2.67 billion in stablecoins. Arbitrum’s Security Council also froze 8,426 ETH and 74.6 million ARB tokens on its network.
The combined value of the frozen assets was approximately $2.7 billion.
However, the attackers reportedly moved quickly to avoid further restrictions. TRM said they sold USDT to market makers and borrowed Ethereum against USDT holdings through the decentralised lending platform Aave.
Despite the freezes, the attackers were reportedly left holding more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion. These assets were considered beyond the reach of centralised token issuers capable of freezing funds.
Binance said it was working with law enforcement agencies to identify those responsible and bring them to justice.
Credits: Reuters
Why Does TRM Labs Suspect North Korea?
TRM Labs attributed the attack to TraderTraitor based on similarities with previous cryptocurrency thefts linked to North Korean hacking groups.
The firm identified several common techniques, including small withdrawals through Tornado Cash to fund operator wallets, preparations beginning well before the actual theft and the use of pre-signed transaction authorisations executed in a concentrated burst.
TRM also pointed to similarities with the April 2026 KelpDAO hack and the February 2025 Bybit theft, both of which were associated with North Korean-linked cyber operations.
However, the laundering methods used in the Binance incident reportedly differed from those observed after the Bybit attack. Instead of relying heavily on cross-chain bridges, the attackers used large transactions through market makers and decentralised lending protocols.
North Korean hacking groups have increasingly been associated with cryptocurrency thefts, with stolen digital assets reportedly serving as an important source of funding for the country’s activities.
The Binance incident highlights the growing sophistication of cyberattacks targeting cryptocurrency infrastructure. With billions of dollars moving across blockchain networks within minutes, the incident also raises questions about exchange security, transaction authorisation systems and the ability of cryptocurrency platforms to contain large-scale thefts.
