#5BusinessGlobal
North Korea Linked to Record $6.3B Binance Crypto Hack
2 Nov 2026, 04:52
Key facts
- Oct 29 2026: ~$6.36B moved from Binance hot wallets across 10 blockchains in ~20 minutes (TRM Labs, Chainalysis).
- FBI attributes theft to North Korea's TraderTraitor (aka Lazarus/APT38), same group behind 2025's $1.5B Bybit hack; funds converted to ETH for laundering.
More detail
- The hack dwarfs prior records like the $620M Ronin (2022) and $1.5B Bybit (2025); NK has stolen ~$12.8B total in crypto since 2017 per estimates.
- Attackers used sophisticated methods including pre-signed authorizations and cross-chain sweeps; FBI urges all DeFi/DEX providers to block listed addresses.
- Binance absorbed the hit via SAFU fund and reserves; users unaffected financially but platform saw rapid $3.6B+ withdrawals testing confidence.
- This escalates US-NK cyber tensions, with funds likely supporting Pyongyang's nuclear and missile programs amid sanctions.
- Direct voices: "If confirmed to be North Korea’s doing, I will discuss this issue with North Korea." – President Trump (via Chosun Ilbo reporting)
The views
State media Side A
North Korean hackers stole $6.3B for weapons
- South Korean state-aligned reporting highlights the FBI's rapid confirmation linking TraderTraitor to the theft.
- It notes the group's history of funding Pyongyang's nuclear and missile programs through crypto crime.
- Coverage stresses the need for international cooperation to block laundered funds and strengthen defenses.
More detail
- Emphasizes fingerprints like commingling with prior NK hacks and use of specific techniques.
- Mentions President Trump's offer to discuss if confirmed, framing it as a national security issue.
- Leaves out deeper questions on Binance's internal controls or exact recovery odds.
- Frames as clear state-sponsored cyber theft requiring stronger sanctions enforcement.
State media Side B
US is the real cybercriminal state
- North Korean state outlets like KCNA have not directly covered this incident in available reports.
- In similar past cases, they reject accusations as 'presumptuous' and accuse the US of being the primary hacker using tools like PRISM.
- Pattern is blanket denial of DPRK involvement while highlighting US cyber aggression.
More detail
Independent Side A
TraderTraitor/North Korea behind record theft
- Blockchain firms TRM Labs, Chainalysis and FBI all tie the precise on-chain movements to known North Korean operators with high confidence.
- The $6.3B haul nearly doubles NK's prior crypto theft totals and directly supports its weapons programs.
- Binance acted fast to cover losses and freeze funds, but the attack reveals state actors' growing sophistication.
More detail
- Details 20-minute main drain using pre-signed txs and cross-chain coordination.
- Notes commingling with earlier 2026 NK-linked hacks for strongest proof.
- Highlights regime's estimated 7,000-strong cyber workforce.
- Calls on industry to block listed addresses to disrupt laundering.
Independent Side B
Hack exposes Binance security failures
- Initial breach traced to a compromised engineer laptop allowing unauthorized hot wallet transactions.
- While NK is suspected, focus belongs on why such a massive centralized platform was vulnerable despite its size.
- Users should self-custody; repeated exchange hacks show the limits of trusting third parties with keys.
More detail
- Coverage notes Binance's own admission on the laptop vector and service container access.
- Discusses rapid outflows post-resumption as a trust signal.
- Downplays geopolitical angle relative to industry-wide custody risks.
- Questions long-term effectiveness of address blacklisting in decentralized finance.
X
Posts from both sides
- Side A: On-chain data clearly maps the $6.3B flows to wallets and tactics used by North Korea's elite hacking unit before.
- Side B: No matter who did it, the lesson is not to leave crypto on exchanges where one laptop can drain billions.
Side A: Western analysts, FBI and South Korea say North Korea's TraderTraitor state hackers stole the $6.3B to fund weapons and should be blocked internationally.
- On-chain data clearly maps the $6.3B flows to wallets and tactics used by North Korea's elite hacking unit before.
- Experts demonstrate how public blockchain lets anyone trace without insider info using the right tools.
- This funds Kim Jong-un's weapons; self-custody is essential because exchanges remain targets.
More detail
- Posts break down specific transactions, Tornado Cash links, and rehearsal activity days prior.
- Stress 'high confidence' matches to Bybit and other Lazarus ops.
- Warn that without blocking by DeFi services, funds will launder successfully.
- Individual analysts urge learning to read the chain yourself.
Side B: North Korea denies cyber theft accusations and says the US is the true cybercriminal state; some focus on Binance's preventable security lapses over geopolitics.
- No matter who did it, the lesson is not to leave crypto on exchanges where one laptop can drain billions.
- Scale shows centralized points of failure; true ownership means not your keys, not your coins.
- Conversation quickly shifts from geopolitics to practical wallet security and avoiding hot wallets.
More detail
- Users share prompts for AI to analyze flows independently.
- Highlight Binance's $3.6B+ post-hack outflows as proof of shaken confidence.
- Note even with attribution, most stolen funds may never be recovered.
- Skeptical that state attribution changes user behavior more than the hack itself.
Most likely true
Multiple independent blockchain firms (TRM Labs with 'high confidence,' Chainalysis, Elliptic) and the FBI link the hack to North Korea's TraderTraitor group via consistent tactics, on-chain trails, and links to prior attacks.
Pyongyang has a documented pattern of state-sponsored crypto theft to fund its regime.
More detail
- Converging evidence from on-chain analysis, behavioral matches to known NK units, and official US confirmation makes the TraderTraitor link the most supported explanation.
- North Korea has both motive (hard currency for weapons) and proven capability; denials follow a standard pattern seen in past incidents.
- Binance's transparency on covering losses helped stabilize the situation, but repeated large hacks signal systemic industry vulnerabilities.
Grey areas
- Exact initial access method beyond the suspected engineer laptop compromise.
- How much of the $6.3B will ultimately be frozen or recovered long-term.
More detail
- While patterns match prior NK ops, full forensic details on the exact laptop compromise or insider element remain limited to Binance's private investigation.
- Recovery success depends on speed of freezes across DeFi protocols; history shows NK often moves funds effectively despite tracing.
Still curious? Ask about this story
Grok checks every side again and answers with sources.
Popular questions
Ask anything about this story. It's free with an account, 1 a week.
Coverage
8 sources · 3 countries
- Official 1
- State-funded 1
- Independent 5
- X / on the ground 1
USQAGB
All sources
- Al JazeeraFBI blames North Korea for record $6.3bn crypto heist from BinanceIndependent · Qatar
- CBS News$6.3 billion Binance hack was likely work of North Korea, blockchain intel firms sayIndependent · United States
- ReutersNorth Korean hackers linked to crypto thefts among world's best, experts sayIndependent · United Kingdom
- CyrilXBTPost on tracing the $6.3B Binance hack to LazarusX / on the ground
- Chosun IlboFBI Confirms North Korea's Binance $6.3B HackState-funded
- CNNBinance crypto hack: North Korea suspected to be behind biggest-ever heistIndependent · United States
- TRM LabsNorth Korea Steals USD 6.36 Billion From Binance in the Largest Hack in HistoryIndependent
- FBINorth Korea Responsible for $6 Billion+ Binance AttackOfficial · United States