Blockchain intelligence firms have attributed the approximately $6.3–$6.36 billion security incident at Binance on October 29, 2026, to North Korea’s TraderTraitor hacking unit with high confidence. TRM Labs stated that an attacker moved roughly $6.36 billion from Binance wallets across ten blockchains, mostly within about 20 minutes, making it the largest crypto theft on record—roughly four times the size of the 2025 Bybit hack.
TRM Labs based its attribution on robust on- and off-chain intelligence, noting similarities to prior TraderTraitor operations, including the Bybit incident previously linked by the FBI to North Korean actors. Chainalysis CEO Jonathan Levin and the firm itself assessed the attack as likely carried out by the same DPRK group, citing links to earlier exploits such as a recent Bitget incident where funds later commingled with Binance proceeds. Elliptic and other analysts similarly concluded North Korean involvement was likely, pointing to shared laundering infrastructure and operational patterns.
Binance reported the estimated impact at around $6.3 billion, with roughly $3 billion frozen through partners including Tether and Circle. The exchange attributed the initial access to a compromised DevOps engineer’s laptop and pledged to cover all losses while suspending deposits and withdrawals. No official government attribution (such as from the FBI) had been issued at the time of early reports.
The Drivers of the Current Situation
The central development is the high-confidence attribution by leading blockchain analytics firms of the record Binance theft to North Korea’s TraderTraitor group. Confirmed elements include the scale of outflows calculated by TRM Labs, the operational parallels to previous DPRK-linked hacks, on-chain connections to prior incidents, Binance’s own impact estimate and recovery measures, and the absence of a formal state-level attribution at the initial stage. These assessments rely on both transaction patterns and intelligence indicators.
Further fund-tracing results or official statements will refine the picture.
Impact and Broader Context
The attribution reinforces the persistent role of North Korean state-linked actors in large-scale crypto thefts used to generate revenue. It raises questions about the sophistication of TraderTraitor tactics (including pre-signed authorizations and rapid multi-chain execution), the effectiveness of industry freezing mechanisms, the ongoing challenges of recovering non-stablecoin assets such as BTC and ETH, and the broader security implications for major exchanges. Coverage distinguishes between the strong analytic consensus and the still-evolving recovery and law-enforcement processes.
Additional freezes, technical post-mortems, or governmental confirmations will shape longer-term responses.
This analysis draws from TRM Labs, Chainalysis, Elliptic reports, Binance statements, and contemporaneous coverage by Reuters, CNN, and others. Final loss figures, full attribution certainty, and recovery outcomes remain subject to ongoing investigation.