Investigators tie multibillion-dollar Binance breach to North Korea
Blockchain intelligence firms and on-chain sleuths have linked a massive multi-billion-dollar breach of Binance to North Korean state-sponsored hackers, after tracing stolen assets across blockchains and matching movement patterns to prior exploits.
Blockchain intelligence firms including TRM Labs and Chainalysis have attributed a massive raid on crypto exchange Binance—with estimated losses ranging from $6.3 billion to $6.4 billion—to North Korea-linked cyber operations, specifically the TraderTraitor unit associated with the Lazarus Group. According to TRM Labs, the attacker spent at least 36 hours preparing the operation before draining funds across 10 blockchains in a blitz that saw the bulk of the transfers leave Binance-linked wallets within roughly 20 minutes, beginning with a $296 million XRP drain.[1][6][7][12][13][14]
On-chain investigator ZachXBT reported that stolen assets from Binance and an earlier $388 million exploit of Bitget converged after being routed through THORChain into the same wallet address, indicating that the same actor was behind both intrusions. Blockchain analytics service MistTrack also observed stolen funds moving through bridges to an address previously connected to the Phemex exploit.[8][9][15]
An on-chain analysis by Bitquery indicated that approximately $3.2 billion remained in wallets controlled by the attacker, including 508,621 ETH accumulated after converting stolen stablecoins and other tokens into ether. Bitquery found no immediate evidence that those remaining funds had been sent to a known exchange or mixer at the time of the review.[5][10]
Binance paused withdrawals following the breach and indicated services were expected to resume within 48 hours. Asset issuers and network protocols, including Tether and Circle, moved swiftly to freeze approximately $2.7 billion to $3 billion in stolen tokens, while Binance announced it has set aside $6.34 billion of its own funds to fully cover user losses.[2][3][4][11][13]
Key facts
- TRM Labs and Chainalysis attributed the Binance exploit of roughly $6.3 billion to $6.4 billion to North Korea's TraderTraitor hacking group.
- TRM Labs reported the attack began with a $296 million XRP drain after at least 36 hours of preparation, moving across 10 blockchains with most funds transferred in about 20 minutes.
- ZachXBT reported that funds from the Binance hack and a $388 million Bitget exploit were routed through THORChain and converged at the same wallet address.
- Bitquery found approximately $3.2 billion remained in the attacker's wallets, including 508,621 ETH, with no signs of transfers to known mixers or exchanges at snapshot time.
- Approximately $2.7 billion to $3 billion in assets was frozen by ecosystem partners and stablecoin issuers following the breach.
- Binance stated it set aside $6.34 billion of its own funds to cover user losses and planned to resume withdrawals within 48 hours.
Sources · 14 sources
- RE
Reuters@ReutersPost on X ·
Blockchain analysis firm TRM says North Korea behind Binance crypto theft https://t.co/UAXaHLBHCS
Open source - LS
Laura Shin@laurashinPost on X ·
TRM Labs pins the Binance hack on TraderTraitor, the North Korean unit the FBI blamed for Bybit. Binance hasn't named an attacker and says withdrawals should restart within 48 hours. https://t.co/axVfSUbZPD
Open source - SO
SolanaFloor@SolanaFloorPost on X ·
🇰🇵NEWS: According to @TRMLabs, North Korea's TraderTraitor hacking group is behind the largest crypto hack in history, which saw approximately $6.36 billion stolen from @Binance across 10 blockchains. The same group was also behind the $1.5 billion Bybit hack in February 2025. Approximately $2.7 billion has been frozen so far.
Open source - CP
Crypto Patel@CryptoPatelPost on X ·
14 years in crypto. I've seen Mt. Gox, the 2018 crash, Terra, FTX and the Bybit hack. Here's what separates the survivors from the casualties: how a team responds when things break. Last night, Binance: → Froze $3B within hours → Paused withdrawals to protect users → Pledged to cover every single loss → Began working with law enforcement and on-chain investigators That's accountability under fire. Meanwhile, some people inside this industry chose to spread FUD instead of helping. You're not exposing anything. You're handing the attacker a win and giving crypto's critics free ammunition. Tether, Circle, Ripple, Arbitrum and Aave all moved fast to contain this. That's what this space looks like at its best. The enemy is the attacker, not the exchange. We rise together or we fall together. 🤝 @cz_binance @binance @tether @circle @arbitrum
Open source - TM
That Martini Guy ₿@MartiniGuyYTPost on X ·
The latest onchain investigation puts approximately $3.2 BILLION in assets still under the Binance attacker's control. Bitquery's latest snapshot identifies 508,621 ETH in the attacker's wallets. That's more than double the 200,630 ETH originally taken, as stolen stablecoins and other tokens were converted into ETH. There's another important detail. Bitquery found no evidence that these remaining funds had been sent to a known exchange or mixer at the time of its latest snapshot. This is far from over.
Open source - CR
CryptoSlate@CryptoSlatePost on X ·
A $296M XRP drain began the $6.36B Binance hack after at least 36 hours of preparation, @trmlabs reports. Most funds left Binance-linked wallets within about 20 minutes, with transfers spanning 10 blockchains. via @hardeyjumoh https://t.co/6mBQP9Td1G
Open source - TE
TechmemeArticle ·
TRM Labs attributes the Binance hack to North Korea-based TraderTraitor, which drained ~$6.36B from Binance wallets across 10 blockchains, mostly in ~20 minutes (Tom Westbrook/Reuters) Tom Westbrook / Reuters : TRM Labs attributes the Binance hack to North Korea-based TraderTraitor, which drained ~$6.36B from Binance wallets across 10 blockchains, mostly in ~20 minutes — North Korean hackers were behind a $6.3 billion raid on cryptocurrency exchange Binance, according to US blockchain analysis firm TRM Labs.
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
ZachXBT: Stolen Funds from the $6.3B Binance Exploit and $388M Bitget Exploit Commingled at Same Address, Suspected Same North Korea-Linked Attacker ZachXBT posted that stolen funds from the $6.3 billion Binance exploit and the $388 million Bitget exploit arrived via THORChain and were commingled at the same address. ZachXBT stated that this indicates the same actor is likely behind both incidents. The Bitget exploit had previously been attributed to the North Korea-linked TraiderTraitor, which has overlap with other previous exploits such as Kelp DAO. According to MistTrack, stolen TRX from the Binance incident flowed through Bitget Wallet Swap Bridge into an address beginning with 0xCd68. On-chain tracking shows that this address was previously used by the Phemex hacker.
Open source - CO
Cointelegraph@CointelegraphPost on X ·
🚨 UPDATE: North Korea’s TraderTraitor group, tied to the $388M Bitget exploit, is likely also behind the $6.3B Binance hack, says ZachXBT. Stolen funds from both landed at one address. https://t.co/ONENEa07e7
Open source - C®
CryptoSavingExpert ®@CryptoSavingExpPost on X ·
Approximately $3.2 BILLION in assets are still under the control of the attacker behind the Binance security incident, according to Bitquery's latest on-chain investigation. The latest snapshot identifies 508,621 ETH across attacker-linked wallets. That's more than double the 200,630 ETH originally stolen, as the attacker converted stolen stablecoins and other tokens into ETH. There's another important detail: Bitquery found no evidence that these remaining funds had been transferred to a known exchange or mixer at the time of its latest snapshot. Billions remain in the attacker's hands, and the trail is still developing.
Open source - JM
Jacquelyn Melinek@jacqmelinekPost on X ·
To no one’s surprise, North Korea is now the lead suspect in the Binance hack. Before Binance, North Korea was estimated to have stolen more than $7.75B in crypto to date. If confirmed, this hack would nearly double that. And add to a long list including: the $387M Bitget hack last month, the $292M Kelp DAO exploit in April and the $1.5B Bybit hack last year. @chainalysis now says it has "a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance," after seeing stolen funds commingle with funds from the Bitget exploit. @zachxbt also flagged that funds from both exploits landed at the same address after moving through THORChain, saying it "indicates the same actor is likely behind both incidents." Binance hasn't attributed the attack itself yet. The team now says its investigation "uncovered additional points of breach" beyond a compromised devops laptop, calling it "a complex attack." About $3B has been frozen so far and Binance expects withdrawals to resume in under 48 hours. For context, only about 5% of the Bybit funds (around $78.9M) have been recovered or frozen so far, which makes the roughly $3B frozen in the Binance hack notable.
Open source - C®
CryptoSavingExpert ®@CryptoSavingExpPost on X ·
NORTH KOREA'S LAZARUS GROUP LINKED TO THE $6.3 BILLION BINANCE HACK. Blockchain intelligence firm TRM Labs has identified North Korea's TraderTraitor hacking unit as the likely perpetrator, citing high-confidence intelligence and similarities to previous attacks. The attackers allegedly spent at least 36 hours preparing before compromising Binance's signing infrastructure and draining wallets across 10 different blockchains. The same hacking group has also been linked to the $1.5 BILLION Bybit hack in 2025. Around $3 BILLION in assets has reportedly been frozen, but billions more remain under the attackers' control. If confirmed, this would be the largest crypto theft in history. This incident is a major reminder that even the biggest exchanges remain targets for highly sophisticated attackers. The investigation is ongoing, and the attribution has not been independently confirmed by Binance.
Open source - DE
DecryptArticle ·
TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor Both firms blame the group behind the Bybit hack, as Binance says it has set aside $6.34 billion of its own funds to cover user losses.
Open source - CR
CryptoSlateArticle ·
Binance hack began with a $296 million XRP drain after 36-hour preparation The Binance attacker spent at least 36 hours preparing for the $6.36 billion crypto exchange hack that began with $296 million in XRP. According to an Oct. 29 investigation by TRM Labs, the attacker began preparing the operation on Oct. 28 before executing coordinated transfers across 10 blockchains the following evening. The blockchain intelligence firm… Read the full story on CryptoSlate Understand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Open source - CN
crypto.news@cryptodotnewsPost on X ·
JUST IN: ZachXBT links Binance and Bitget exploits after stolen funds converge at one wallet The investigator says funds from the reported $6.3B Binance breach and $388M Bitget hack were routed through THORChain and commingled at the same address, suggesting both incidents may involve the same attacker.
Open source