Suspected North Korean Binance Hack Puts Crypto Theft at the Centre of Regime Funding

Billions moved in minutes, followed by a race to freeze them

About $6.36 billion in cryptocurrency moved out of Binance wallets across 10 blockchains on October 29, 2026, most of it in roughly 20 minutes, according to blockchain intelligence firm TRM Labs. TRM and Chainalysis linked the attack to TraderTraitor, a hacking group associated with North Korea, in what would be the largest cryptocurrency theft on record.

Binance said it had secured roughly $3 billion in affected assets and set aside more than $6.34 billion of company money to cover losses. The exchange initially suspected an engineer's compromised laptop, then said investigators had uncovered a wider breach. Withdrawals were suspended while the company investigated and worked to recover funds.

The suspected theft brings together two problems: the security of money held by a major cryptocurrency exchange and North Korea's use of cybercrime to obtain foreign currency. Estimates cited in connection with UN Security Council investigations put stolen funds at roughly half of the country's foreign currency income and about 40% of its weapons development costs.

TRM's estimate of the Binance outflow includes assets subsequently frozen. The immediate struggle is therefore over how much can be recovered, how customers regain access to their holdings and how much remains accessible to the attackers. Binance has promised to cover every loss, while investigators continue examining the route into its systems and the identity of those responsible.

What happened inside Binance?

TRM said the attackers prepared for at least 36 hours before moving funds from multiple Binance wallets. The theft affected networks including Ethereum, Bitcoin and Solana. A blockchain is a shared digital record of transactions; moving assets across several networks gives investigators several trails to follow at once.

Binance co-CEO Richard Teng said the investigation had moved beyond its initial focus on a laptop:

This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.

Teng also said the attackers used a mechanism that destroyed their tools and traces as they went. Binance said it had found no evidence that a wallet private key had leaked. A private key is the secret digital credential used to authorise cryptocurrency transfers. The company has not yet published a complete technical explanation of the breach.

Why investigators suspect TraderTraitor

Chainalysis identified a connection in the movement of the money: cryptocurrency taken from Binance appeared on the blockchain mixed with funds stolen from Bitget the previous month. The September Bitget theft, estimated at $387 million, has also been attributed by researchers to North Korean hackers.

TRM pointed to preparations and transaction patterns resembling earlier attacks linked to North Korea, including the $1.5 billion theft from Bybit in February 2025. Chainalysis co-founder and CEO Jonathan Levin also identified TraderTraitor as the likely attacker.

TraderTraitor is described as a group backed by the North Korean state and established under an intelligence agency around 2016 or 2017. Researchers associate it with the wider Lazarus network. DTEX researcher Michael Barnhart described its personnel as experienced financial attackers, including operators associated with APT38, another designation used for North Korean cyber operations.

The FBI formally attributed the Bybit theft to North Korea and TraderTraitor five days after that attack. Attribution of the Binance breach currently rests on assessments by the blockchain intelligence firms. Binance said it was working with law enforcement to confirm the criminals' identities. North Korea has denied involvement in cryptocurrency theft.

How stolen cryptocurrency becomes harder to recover

Chainalysis said the Binance funds passed repeatedly between wallets through thousands of transactions in a short period. Investigators described activity occurring within about 20 minutes, with patterns suggesting automated programs were helping move the assets.

A cryptocurrency wallet is a tool for controlling digital assets and authorising transactions. Moving stolen funds between many wallets creates a more complicated trail, even though transactions on public blockchains remain visible. Investigators must work out which transfers belong to the attackers and where exchanges or other businesses may be able to stop them.

Speed also matters because some assets can be frozen by their issuers. Chainalysis said approximately $325 million in stolen stablecoins was exchanged for ether, the cryptocurrency used on Ethereum, in about 20 minutes. Stablecoins are tokens designed to track another asset, often the US dollar. Issuers can freeze certain stablecoin holdings, while ether has no issuer with the same freezing power.

TRM said Chinese brokers trading outside conventional exchanges buy stolen cryptocurrency at a discount. Such brokers can help turn digital assets into spendable money. For North Korea, that conversion is the bridge between a successful computer intrusion and funds usable by the regime.

How much was stolen, and how much is secured?

TRM calculated the Binance outflow at approximately $6.36 billion using prices when the assets moved. The incident has generally been described as a theft of about $6.3 billion. That is more than four times the $1.5 billion stolen from Bybit in 2025.

Early freezing estimates were about $2.7 billion from TRM and $2.8 billion from Chainalysis. Binance subsequently said roughly $3 billion had been secured, close to half the initial outflow. The company also said it was actively buying cryptocurrency tokens as part of its effort to cover losses.

Binance initially announced a suspension of deposits and withdrawals on October 30, Japan time. Its later updates said deposits were unaffected while withdrawals remained paused. The exchange expected withdrawals to resume within a day or two, although a firm reopening time was not given.

Binance said its exchange serving the United States was unaffected. The US Secret Service said it was working to identify, freeze, trace and recover funds, and Binance said it was cooperating with the FBI. Assets connected to US companies, including stablecoins from Tether and Circle, were among those involved.

Customers also face a legal issue alongside the technical recovery effort. Daniel Tunkel, a lawyer at Edwin Coe in London, said recovery rights would depend on contractual promises and where customers could sue Binance if it failed to perform. Binance's commitment to cover losses places the immediate financial burden on the company.

A growing share of global cryptocurrency losses

Chainalysis estimated that North Korean hackers stole $2.02 billion in 2025, compared with $1.34 billion in 2024. That represents an increase of about 51%. The Bybit theft alone accounted for roughly three quarters of the 2025 figure.

For 2026, Chainalysis put the North Korean share of reported cryptocurrency hacking losses at 89%, up from 15% in 2021. TRM estimated an 85% share for 2026, falling to 45% when Binance was excluded. The Binance incident therefore accounts for much of the sharp rise in the annual figures.

Chainalysis also estimated that average losses per suspected North Korean attack rose from $50.65 million in 2021 to $185.65 million in 2026. Dividing those figures shows an increase of approximately 3.7 times, indicating that the financial damage per incident has grown substantially.

For January 2021 through October 29, 2026, figures attributed to Chainalysis put global losses at $22.34 billion and North Korea linked losses at $13.24 billion, about 59%. Another tally attributed to the firm gave $22.034 billion and $13.024 billion respectively, also about 59%.

TRM estimated 100 North Korean attacks since 2017, with $12.8 billion stolen, including $7.4 billion in 2026. Barnhart put cumulative theft at about $13.5 billion. Those estimates cover different periods and sets of incidents, making their stated time frames essential to understanding the totals.

Why the money matters to Pyongyang

UN Security Council expert panel investigations identified 58 suspected North Korean attacks against cryptocurrency companies between 2017 and 2023, involving about $3 billion in losses. The scale has since grown, with a single suspected Binance operation now exceeding that earlier total.

North Korea faces extensive international sanctions that restrict its access to trade and finance. Cryptocurrency theft provides a route to foreign currency outside ordinary exports. Estimates associated with the UN panel put hacking proceeds at about half of North Korea's foreign currency income, while stolen funds have been estimated to cover roughly 40% of weapons development costs.

The $6.3 billion Binance theft has been compared with about one fifth of North Korea's gross national income. Gross national income measures income earned by a country's residents and businesses over a year. The comparison shows why a theft of this size matters far beyond the exchange's customers.

North Korea has long faced allegations of other illegal efforts to earn foreign currency, including sophisticated counterfeit US $100 notes in the 1990s and methamphetamine production and trafficking in the 2000s. Cyber operations offer the regime a way to target businesses abroad through computer networks.

Years of training behind the attacks

North Korea reportedly selects children with strong mathematics and science skills for three to five years of cyberwarfare training. Promising students then advance into specialist university programs, creating a continuing supply of technically trained personnel.

The Committee for Human Rights in North Korea described a five year course at Moranbong University in Pyongyang combining military studies, hacking and cryptanalysis. Cryptanalysis means studying how to break codes or defeat systems designed to keep information secret. Some elite operatives reportedly receive further training in China and Russia.

Former South Korean Vice Defense Minister Shin Beom-chul described North Korean hackers as highly aggressive and skilled, trained for the regime's foreign currency operations. State backing gives these teams sustained support and allows them to operate without the domestic prosecution risks facing many other criminals.

Fake jobs can open the door

TraderTraitor's methods often begin with people rather than a direct attack on a cryptocurrency wallet. The group targets developers and information technology staff with fake recruitment approaches, supposed business partnerships and malicious software disguised as something needed for work.

A joint warning issued in 2022 by the FBI, the Cybersecurity and Infrastructure Security Agency and the US Treasury described malware and deception aimed at cryptocurrency businesses. Barnhart described sham job interviews in which applicants are persuaded to download malicious software, exposing login credentials and sensitive information.

Security specialists call this social engineering: persuading a person to take an action that helps an attacker. Once a computer is compromised, attackers can use it to explore an organisation's internal systems and seek authority to move money.

Nyxlab co-founder and CEO Kok Tin Gan suggested that the Binance attack may have involved a signature granting a token with continuing, extensive access to an internet connected wallet. That remains his proposed explanation while Binance investigates the complete chain of events.

From Sony to Binance: the expanding operations

North Korean cyber operations have included political disruption as well as financial theft. The Sony Pictures attack in 2014 was widely viewed as retaliation for a comedy depicting a plot to assassinate Kim Jong Un. Later incidents show an expanding focus on large cryptocurrency holdings.

• 2014: The Sony Pictures hack brought global attention to North Korean cyber operations.
• 2022: The Lazarus group was linked to the theft of about $620 million from the Ronin Network, which supports a blockchain game.
• 2024: TraderTraitor was attributed responsibility for stealing $308 million from Japan's DMM Bitcoin exchange.
• February 2025: Bybit lost about $1.5 billion in an attack the FBI attributed to North Korea.
• April 2026: Analysts attributed thefts of $285 million from Drift and $292 million from KelpDAO to North Korean hackers.
• September 2026: Bitget lost about $387 million in a theft researchers linked to the same network.
• October 29, 2026: Approximately $6.36 billion moved out of Binance wallets across 10 blockchains.

Drift and KelpDAO operate in decentralised finance, often called DeFi, where software running on blockchains performs financial transactions. The targets therefore extend beyond conventional exchanges to systems that hold or transfer funds through automated programs.

Artificial intelligence could make parts of these operations faster. Simon Choi, chief technology officer at cybersecurity company StealthMole, warned that AI helps attackers find security weaknesses and automate attacks. Investigators have also identified signs of automation in the movement of Binance funds, while the company's technical investigation continues.

Key Points

• TRM estimated that $6.36 billion left Binance wallets on October 29, 2026, mostly within about 20 minutes.
• TRM and Chainalysis linked the suspected theft to North Korea's TraderTraitor group.
• Binance said roughly $3 billion had been secured and more than $6.34 billion set aside to cover losses.
• Chainalysis estimated North Korea's share of reported global cryptocurrency hacking losses at 89% in 2026.
• Investigators are examining a breach involving multiple entry points, while Binance has yet to publish its full technical findings.
• Cryptocurrency theft provides foreign currency that is estimated to help fund North Korea's weapons programs.