Skip to the article
Onchain Brief

News from across crypto

Analysts link $6.3 billion Binance theft to North Korea

Blockchain firms say North Korea-linked hackers likely stole $6.3 billion from Binance; the exchange says it froze about $3 billion and is recovering assets.

The Onchain Brief Editors2 min read
Analysts link $6.3 billion Binance theft to North Korea

Blockchain intelligence firms say North Korea’s TraderTraitor hacking group likely stole about $6.3 billion from Binance, the world’s largest cryptocurrency exchange. TRM told the Associated Press that it had high confidence in the attribution, but no government has confirmed who was behind the theft.

How much was stolen, and how?

TRM said an attacker moved about $6.36 billion from Binance wallets on ten blockchains, with most of the funds moving in about 20 minutes. Elliptic, another blockchain analysis firm, put the total at $6.43 billion across 11 blockchains on Oct. 29.

Elliptic’s analysis of the Binance theft says the attacker took tokens including USDT and USDC, as well as bitcoin and ether. Binance said its initial investigation pointed to a possibly compromised laptop. The exchange later said it had found additional “points of breach,” without explaining what they were.

Binance said it found no evidence that wallet private keys had been leaked. Private keys are the secret codes used to authorize crypto transactions. Its investigation is ongoing.

What has Binance done to recover the funds?

Binance said it worked with blockchain partners to freeze about $3 billion in affected assets and had begun recovering assets for users. It said deposits were unaffected, withdrawals were suspended during security checks, and it would cover all losses.

Elliptic independently verified about $2.84 billion in frozen funds in its analysis. It said the attacker had also started swapping some assets and moving funds between blockchains. Some crypto tokens can be frozen by their issuers; assets such as bitcoin and ether generally cannot be frozen by a central issuer.

What supports the North Korea link?

TRM cited similarities to earlier thefts linked to North Korea, including the 2025 Bybit hack. Chainalysis also said the Binance theft was likely carried out by TraderTraitor, according to the AP report. Those are assessments by private firms, not an official finding.

Elliptic said the evidence included a small overlap between addresses that received Binance funds and proceeds from a separate suspected North Korea-linked theft. It cautioned that this link does not prove the same hackers carried out both attacks. Binance said it was working with law enforcement to confirm the criminals’ identities.

References