In brief
TRM Labs links the $6.36 billion theft to a North Korean group called TraderTraitor, noting the transfer occurred in about 20 minutes across ten blockchains. Binance has pledged to cover losses and is working to recover assets. Multiple outlets report North Korean involvement.
On Oct. 30, a U.S. blockchain intelligence firm said it believes North Korean hackers carried out the largest cryptocurrency theft on record, siphoning an estimated $6.36 billion from Binance, the world’s largest crypto exchange.
Investigation and Attribution
TRM Labs identified the attack as most likely carried out by the TraderTraitor group, “high confidence” in its attribution based on transaction analysis and similarities to prior North Korean hacking operations. The hackers reportedly began preparing at least 36 hours before the incident, gaining access to Binance’s transfer‑authorization systems and moving funds across ten blockchain networks in roughly 20 minutes.
The firm notes that about $2.7 billion of the stolen assets have been frozen through cooperation among cryptocurrency companies and blockchain operators, while roughly $2.4 billion of Bitcoin and Ethereum remain under the hackers’ control. TRM Labs warned that the perpetrators may continue to move stolen funds between networks and trading platforms to obscure their origin.
BINANCE has announced that it will cover all losses from its own reserves and is working to recover the assets. Co‑CEO Richard Teng wrote on X that the exchange is “working non‑stop” to resolve the issue, adding that it has reserved over $6.34 billion in company funds to cover the theft, with $5 billion already held in the exact token assets that were impacted.
"We are committed to covering all hacked losses through our company funds. Your assets are safe," he wrote.
U.S. officials have highlighted that North Korea relies on networks of nationals abroad and foreign facilitators in China, Russia, Cambodia, and Vietnam to launder stolen digital assets into fiat currency for procurement and weapons programs.
Different media outlets have reported on the incident. The Yonhap news agency released a detailed account of TRM Labs’ findings and Binance’s response. The The Advocate and Maitland Mercury outlets both reported that analysts blame North Korean hackers for the heist, echoing the same attribution but offering less technical detail.
The U.S. Federal Bureau of Investigation has also been informed and is working with partners to understand the scope of the attack. TRM Labs noted the FBI’s earlier attribution of a $1.5 billion theft from Bybit in February 2025 to TraderTraitor, suggesting a pattern of large-scale operations.
While the scale of the theft exceeds all prior incidents, analysts emphasize the need for continued cross‑border cooperation to track and freeze stolen assets, and to address the broader risk of state‑backed cyber‑crime in the global financial system.
