TRM Labs has expressed high confidence in North Korea-linked hacking unit TraderTraitor’s involvement in the massive Binance breach, citing similarities with previous cyberattacks.
BY PC Bureau
October 30: A cryptocurrency theft estimated at more than $6.3 billion has sent shockwaves through global digital-asset markets, with blockchain investigators pointing to a notorious North Korean hacking unit as the likely culprit. The attack, which reportedly unfolded within just 20 minutes on October 29, 2026, is being described as the largest cryptocurrency heist on record.
Blockchain intelligence firm TRM Labs said it had “high confidence” that TraderTraitor, an elite North Korean cybercrime unit associated with the Lazarus Group, was behind the operation. Its assessment is based on on-chain and off-chain intelligence, as well as similarities with previous attacks attributed to North Korean hackers, including the $1.5 billion theft from Bybit in February 2025.
READ: Massive Binance Hack: $3 Billion Frozen, Users Await Clarity
🚨 UPDATE: North Korea’s TraderTraitor group is behind the $6.3 billion Binance hack, according to a high-confidence attribution by TRM Labs.
The attackers reportedly prepared 50 signed authorizations before draining a Binance hot wallet.
About $2.7 billion in assets has been frozen, but billions remain under attacker control.
Full details ↓ https://t.co/Yo4ig1I5m5
— The Hacker News (@TheHackersNews) October 30, 2026
According to TRM Labs, attackers moved approximately $6.36 billion from Binance wallets across ten blockchains, with most of the transfers taking place within a brief window. Chainalysis co-founder Jonathan Levin also suggested on X that the operation was likely the work of TraderTraitor, citing links to earlier North Korean hacking campaigns.
Binance described the incident as a complex attack involving approximately $6.34 billion in funds. The exchange said it was working with blockchain partners, law enforcement agencies, asset issuers and intelligence firms to trace and recover the stolen cryptocurrency. It reported that around $3 billion had already been frozen.
The exchange also said it had set aside more than $6.34 billion in company funds, including $5 billion in the same token assets affected by the breach, to cover potential losses. It has begun recovering assets for users and suspended certain withdrawals as investigations continue.
TraderTraitor is believed to operate within the broader Lazarus Group, a North Korean state-linked hacking network accused of carrying out major cyberattacks and cryptocurrency thefts. Investigators believe proceeds from such operations help finance North Korea’s weapons programmes. The FBI previously attributed the February 2025 Bybit heist to the group.
North Korean hackers have been linked to several high-profile cyberattacks over the past decade, including the 2014 Sony Pictures breach, which was associated with the release of the film The Interview.
The scale of the Binance incident rattled cryptocurrency markets. Bitcoin reportedly fell by around 4–5 per cent, touching approximately $77,465 in one account. Ethereum declined by roughly 5–6 per cent, while several other major tokens also recorded losses. Binance’s native BNB token slipped by about 1 per cent.
Analysts say the speed and scale of the transfers, along with techniques resembling those used in earlier North Korean operations, have strengthened suspicions about TraderTraitor’s involvement. However, investigations are continuing, and no formal government attribution of the attack has been publicly announced.
