E-Paper
North Korea behind $6.3 billion Binance crypto theft, Blockchain analysis firm TRM says
Blockchain analysis firm TRM said that North Korean hackers were behind the $6.3 billion Binance crypto theft.
Prefer HTon Google
North Korean hackers were behind the $6.3 billion Binance crypto theft, US blockchain analysis firm TRM Labs said on October 30. They attributed the attack to TraderTraitor, North Korea's elite hacking unit.
In a blog post, TRM said, “An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes,” adding, “TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.”
This is the largest crypto theft on record, with the $1.5 billion stolen in the Bybit hack in February 2025, coming in second place. Binance, in its latest statement, had noted that the hack likely involved a “compromised DevOps engineer's laptop.”
“Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified,” they said, adding that $3 billion had been frozen thus far. The company promised to “cover all losses” from the SAFU fund and the company’s funds and noted that it was working with law enforcement to “confirm the identity of these criminals and bring them to justice.”
How North Korean hackers allegedly stole the crypto?
TRM explained how the North Korean hackers allegedly stole cryptocurrency from Binance. “On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorizations prepared in advance. In the same window, Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers,” they noted.
Also Read | Once barred in US, now at centre of a billion-dollar crypto heist: All about Binance
They added that this pointed to a compromise in Binance's hot wallet signing infrastructure. “Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion. The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach,” TRM further explained about the hack and subsequent fund freezing.
Why TRM feels North Korea is behind the hack?
TRM attributed the hack to North Korea noting “several features of this attack match earlier North Korea-linked heists.” The same group has been blamed for the Bybit hack as well.
The US Blockchain analysis firm noted there were similarities with the April 2026 KelpDAO hack as well. The firm explained there were “small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit.”
Deep Dive
