North Korea Suspected in $6.3 Billion Binance Hack, Blockchain Investigators Say

North Korean-linked hackers are suspected of carrying out the record-breaking cyberattack on Binance, the world’s largest cryptocurrency exchange, which resulted in the theft of approximately $6.3 billion in digital assets.

Blockchain intelligence firms TRM Labs and Chainalysis have linked the October 29 attack to TraderTraitor, a hacking unit associated with North Korea and the wider Lazarus Group network.

TRM Labs said its assessment was based on intelligence gathered from blockchain transactions and other investigative information, adding that it had high confidence in the attribution. The reported theft involved approximately $6.36 billion transferred from Binance wallets across multiple blockchain networks, with most of the funds moved within about 20 minutes.

Investigators identified similarities between the Binance incident and previous cryptocurrency thefts attributed to North Korean cybercriminal groups.

According to blockchain researchers, the attackers used sophisticated methods to access Binance’s wallet infrastructure and move large quantities of digital assets into wallets under their control.

The attack has been linked to TraderTraitor, a North Korean hacking operation known for targeting cryptocurrency companies and financial technology organisations. The group has previously been associated with major digital asset thefts, including the $1.46 billion Bybit hack in February 2025.

However, the attribution remains an assessment by blockchain intelligence firms. Binance has not independently confirmed North Korea’s involvement, and no final public law enforcement determination has been announced.

Following the breach, Binance announced that it would absorb the financial losses rather than pass them on to customers. The exchange said it had reserved more than $6.34 billion in company funds to cover the affected assets.

Binance has also worked with blockchain security companies, token issuers and other industry partners to freeze some of the stolen cryptocurrency. Approximately $3 billion in affected assets had been located or frozen, according to reports. The company said it was cooperating with law enforcement agencies to investigate the incident and identify those responsible.

North Korean-linked hacking groups have repeatedly been accused of stealing cryptocurrency as a way of generating revenue outside the traditional financial system.

Cybersecurity experts and government agencies have previously linked these operations to efforts to evade international sanctions and generate funds for North Korea’s military and weapons programmes.

Cryptocurrency exchanges and decentralised finance platforms have become attractive targets because large amounts of digital assets can be moved across international networks without relying on conventional banking systems.

The Binance breach has raised fresh concerns about the security of digital asset platforms and the risks associated with centralised cryptocurrency exchanges. Although Binance has assured customers that it will cover the losses, the scale of the incident could affect investor confidence and increase pressure on cryptocurrency companies to strengthen their internal security systems.

For now, investigators are continuing to trace the stolen assets and examine how the attackers gained access to Binance’s infrastructure.