Blockchain Firms Tie Record Binance Theft to North Korean Hackers: The Key Numbers

Two blockchain analysis firms say North Korea's TraderTraitor hacking unit was likely behind the theft of more than $6 billion from Binance, the world's biggest cryptocurrency exchange. According to the AP and CBS News, Binance has suspended withdrawals, says deposits were unaffected and has promised to cover all losses.

TRM, a U.S.-based firm, said it reached its conclusion with high confidence. Binance has not confirmed who was responsible. A spokesperson told the AP only that the company is working with law enforcement to identify the culprits.

The central numbers in the Binance hack

• USD 6.36 billion: The amount TRM says an attacker moved out of Binance wallets. If the figure holds, TRM said, it would be the largest cryptocurrency theft on record. Headlines have rounded it to $6.3 billion.
• About 20 minutes: TRM said most of the money moved in roughly this window, across ten blockchains.
• Roughly $3 billion: The amount of affected assets Binance says it froze with blockchain partners, according to the AP and CBS News. Finbold reported a lower figure, more than $2 billion, so reports differ on how much has been frozen.
• $1.5 billion: The Bybit exchange hack in early 2025. The FBI attributed it to North Korea and TraderTraitor, and TRM says the Binance attack shares several features with it.
• $1.1 billion: The approximate value of Bitcoin in Binance's emergency SAFU fund on the morning of Friday, Oct. 30, according to Finbold.
• 233.46 million XRP: According to Finbold's summary of TRM's report, five Binance wallets sent this amount to a single attacker address on the XRP Ledger in the first major theft.

How TRM says the attack unfolded

Finbold, summarizing TRM's report from Oct. 29, said the operation began about 36 hours earlier. The attacker's operator wallet received three small withdrawals from Tornado Cash, a service that mixes digital assets. TRM said the group then rehearsed on two wallets, deployed its code early on Oct. 29 and installed the same code on a Binance hot wallet.

TRM also pointed to similarities with the Bybit hack and an April 2026 hack of KelpDAO. It said all three involved small Tornado Cash withdrawals that funded an operator wallet, preparation that began well before the theft, and signatures obtained in advance and then used in one burst. The laundering seen so far differs from the pattern after Bybit, TRM said, relying on large swaps through market makers and lending protocols rather than bridges.

Chainalysis co-founder and CEO Jonathan Levin wrote on X that the hack was likely the work of TraderTraitor.

What Binance and others have said about the breach

Binance said an initial investigation pointed to a compromised laptop, but a later review found additional points of breach. The company also said it had found no evidence of any wallet private key leak and would release more technical details when its probe ends.

Kok Tin Gan, CEO of cybersecurity firm NyxLab, said the incident raises questions about why stronger approval controls were not in place. He said it looks like one signature gave the attacker a "never-expiring, full-access token" to a Binance hot wallet.

Binance founder Changpeng Zhao, who no longer runs the company, wrote on X that user funds are safe and that the theft does look like a hack on Binance. As a shareholder, he said, he expects all user funds to be fully covered. According to Finbold, he also floated using the company's SpaceX stock stake to cover some of the losses.

Why it matters for Binance users and the crypto market

For customers, the immediate effect is that withdrawals are paused. Binance said they are expected to resume in the next day or two, and that deposits are unaffected. The company has said it will cover all losses, though it has not yet released the technical findings of its investigation.

The scale is also notable by comparison. Finbold Research reported that roughly $1.17 billion was stolen across the entire third quarter of 2026, a small fraction of the amount taken from Binance in one episode.

Experts told the AP that North Korea has turned to crypto hacking as a source of badly needed foreign currency to support its economy and fund its nuclear program, in the wake of tough U.N. sanctions. In December 2022, South Korea's spy agency estimated that North Korean hackers had stolen 1.5 trillion won ($1.1 billion) in virtual assets over the previous five years. It said the country's ability to steal digital assets was considered among the best in the world.

What comes next

Binance says it will publish more technical details once its probe is complete, and TRM has said it will release more information as its own investigation continues. Binance is also working with law enforcement to confirm who was behind the attack.

Around Prague, based on reporting by Upper Michigan's Source, Finbold, CBS News