Researchers Tie Binance's $6.3 Billion Theft to North Korean Hackers

By Coinvote

Published October 30, 2026 - 07:22 UTC | 5 mins read

Binance says the breach cost about $6.3 billion and that roughly $3 billion has been frozen onchain. Blockchain analysts including TRM Labs and Chainalysis point to North Korea's TraderTraitor group, though the exchange has not named a culprit.

Binance puts the damage at $6.3 billion and promises to cover it

Binance confirmed on Thursday that it suffered a security breach, estimating the total impact at about $6.3 billion. Bitcoin Magazine reported that the figure is higher than earlier estimates, which ranged from $2.7 billion to $5.8 billion. If it holds, the incident would rank among the largest crypto thefts on record.

Binance said that, together with blockchain partners, it has frozen roughly $3 billion of the affected assets onchain to date. The Defiant added that withdrawals are still suspended. Binance said it will cover all losses from its SAFU fund and company funds, and that it will publish an updated Proof of Reserves once remediation is complete.

According to Bitcoin Magazine, concern first arose when a user spotted over $2.7 billion in Ethereum and Tether- and Circle-issued stablecoins being sent from a Binance wallet to an outside account in suspicious circumstances.

A compromised engineer laptop is the working theory

In a post on X, Binance said its initial investigation suggests a DevOps engineer's laptop may have been compromised. The attacker reportedly used that foothold to reach a service container and submit unauthorized withdrawal transactions, Bitcoin Magazine reported.

Binance said it has found no evidence that a wallet private key leaked. The exchange said it cancelled the authorization of the affected address and is trying to establish the identities of those responsible. A detailed technical post-mortem will follow once the facts are verified, but the exchange has not given a timeline for it.

The figures that define the incident

The numbers differ slightly depending on who is counting, so it helps to keep them side by side.

Binance's estimate of total impact: about $6.3 billion.
Chainalysis chief executive Jonathan Levin's figure for the stolen amount: $6.4 billion.
Earlier estimates cited by Bitcoin Magazine: between $2.7 billion and $5.8 billion.
Assets frozen onchain so far, per Binance: about $3 billion.
Tether freezes: more than 1.567 billion USDT, according to its chief executive Paolo Ardoino, with Circle also freezing USDC tied to the suspected attacker.

Analysts converge on North Korea's TraderTraitor

Cointelegraph reported that TRM Labs attributed the attack to TraderTraitor with "high confidence," citing onchain and offchain intelligence. Chainalysis's Levin said the hack was "likely done by DPRK group TraderTraitor due to links to previous hack."

Onchain investigator ZachXBT added a concrete link. He said funds stolen from Binance and from the earlier Bitget exploit were commingled at one address after passing through THORChain. He said the overlap suggests one actor probably carried out both attacks, noting that the Bitget theft had already been pinned on TraderTraitor. Blockaid chief executive Ido Ben-Natan had earlier told Cointelegraph that the sophistication and onchain preparation resembled North Korean activity.

CoinDesk framed the findings around the Lazarus Group, reporting that security researchers suggested the group was responsible for Thursday's hack, which it put at nearly $6 billion, at the largest crypto exchange in the world.

Where the outlets agree and where they differ

All four outlets agree on the core story: a very large Binance loss on Thursday and researchers pointing to North Korea. They differ on labels and amounts. Cointelegraph reports Binance's $6.3 billion estimate and attributes the $6.4 billion figure to Chainalysis CEO Jonathan Levin. The Defiant's headline uses the $6.4 billion Chainalysis figure, while its summary and Bitcoin Magazine report Binance's $6.3 billion estimate. CoinDesk's summary describes the loss only as nearly $6 billion.

The group names also differ. Cointelegraph uses TraderTraitor throughout, while CoinDesk refers to Lazarus. The CoinDesk and Defiant pieces were available only as headlines and summaries, so their details beyond those lines are not established here.

Only Bitcoin Magazine carries Binance's technical account, including the laptop theory and the other responses. It also reported that Aave reportedly paused its lending markets so the suspected attacker could not borrow against the stolen funds, and that Binance.US said its platform is unaffected. Cointelegraph's added value is the attribution trail and the history of the group.

Why the TraderTraitor playbook matters for exchanges and projects

Cointelegraph noted that US authorities have connected TraderTraitor with several of the biggest thefts in crypto, among them the February 2025 Bybit hack. Together with Japanese investigators, the FBI also blamed North Korean actors for the May 2024 DMM Bitcoin theft, which exceeded $300 million.

The FBI says the group goes after employees of companies using social engineering. In the DMM case, the attacker pretended to be a recruiter and sent a booby-trapped coding test to a staff member at wallet provider Ginco. Investigators said the access gained was probably used to alter a genuine transaction request, sending the funds to wallets under the attacker's control.

That pattern resembles what Binance describes, where an engineer's machine is the suspected entry point rather than a broken cryptographic key. Binance has not said the two incidents are connected in method, so the comparison remains an open question. For project teams, the practical point is that employee devices, build tooling and withdrawal approval flows are part of the attack surface alongside smart contracts.

Market reaction and open questions

Bitcoin Magazine reported that bitcoin fell to $76,301 while news of the hack circulated, having touched a 24-hour high of $81,890 earlier in the session. It said millions in leveraged long positions were liquidated. The outlet put the price near $77,800 afterward, and CoinGecko data now shows $78,363.

Several questions remain open. Binance has not said when withdrawals will resume or how much of the $3 billion in frozen assets can be recovered. It has not published its post-mortem or confirmed the attribution itself. Readers can follow official Binance channels, which the exchange asked users to rely on, and watch for the updated Proof of Reserves.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$78,363	-1.8%	-3.9%	$1.58 trillion
Ethereum (ETH)	$2,247	-2.6%	-6.3%	$274.56 billion
Aave (AAVE)	$126	-2.8%	-14.9%	$1.94 billion

CoinGecko data as of 2026-10-30 (UTC).

FAQ

How much did Binance lose in the hack?

Binance estimates the total impact at about $6.3 billion, while Chainalysis's chief executive put the stolen amount at $6.4 billion. Bitcoin Magazine reported that earlier estimates ranged from $2.7 billion to $5.8 billion.

Who is behind the Binance hack?

Binance has not named an attacker. TRM Labs, Chainalysis and ZachXBT linked the theft to North Korea's TraderTraitor group, and CoinDesk reported researchers pointing to the Lazarus Group.

Are user funds at Binance safe?

Binance and co-founder Yi He say user funds are safe, and the exchange says it will cover all losses from its SAFU fund and company funds. Deposits and withdrawals remain suspended while security checks continue.