Binance’s $6.3B crypto heist: Who’s behind it?

Binance hack: Hackers linked to North Korea are the main suspects in the theft of about $6.36 billion from Binance, the world’s largest crypto exchange. US blockchain analysis firm TRM Labs says the group is TraderTraitor, which it calls North Korea’s elite hacking unit. Binance has not confirmed this yet.Who is behind the Binance hack?TRM Labs published its findings on Thursday. It says the attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it in around 20 minutes. If the figure holds, this is the largest crypto theft on record.Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them.Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected.The outflows ceased when we paused withdrawal service earlier. We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far.We will continue to provide further updates through official Binance channels as more verified information becomes available.— Binance (@binance) October 30, 2026TRM says it blames TraderTraitor “with high confidence,” based on on-chain and off-chain intelligence. It also says several features of the attack match earlier North Korea-linked thefts, including the Bybit hack.Chainalysis, another blockchain analytics firm, has a similar view. Its co-founder and CEO, Jonathan Levin, wrote on X that the hack was likely done by TraderTraitor.Hackers stole $6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a record theft that analysts pinned on North Korea. https://t.co/NIX65d8FpF— USA TODAY (@USATODAY) October 30, 2026Binance has not named anyone. A company spokesperson said only that it is working with law enforcement partners to confirm the identity of the criminals and bring them to justice.Is TraderTraitor a state-backed group?TRM describes TraderTraitor as a unit of North Korea, which would make it state-backed. No government has confirmed its role in the Binance case so far. The link comes from private security firms.The Bybit case offers some background. In February last year, Bybit lost $1.5 billion in a hack. The FBI said North Korea and TraderTraitor were responsible.Experts say North Korea turned to crypto theft because it needs foreign currency. Strict UN sanctions have hurt its economy, and the money is believed to help fund its nuclear programme.In December 2022, South Korea’s spy agency said North Korean hackers had stolen around $1.1 billion in crypto and other digital assets in the previous five years, more than half of it in 2022 alone.How the theft happened and what Binance says nowBinance first said the attacker may have got in through a compromised laptop belonging to an employee or contractor, which allowed unauthorised withdrawal requests. A later check found more “points of breach,” the company said. It also said it found no evidence that any wallet private key had leaked.Kok Tin Gan, CEO of cybersecurity firm NyxLab, believes a single signature may have given the attacker a never-expiring, full-access token to a Binance hot wallet. A hot wallet is one connected to the internet. He questioned why stronger approval controls were not in place.Binance says it froze roughly $3 billion of the affected assets with help from blockchain partners. Deposits were not affected. Withdrawals are suspended and should resume in a day or two.The company says it will cover all losses and will share more technical details once its investigation ends.Changpeng Zhao, who founded Binance, posted on X that “User funds are safe!” He said it does look like a hack, and that as a shareholder he expects all funds to be fully covered. Zhao pleaded guilty in 2023 to a felony linked to failing to prevent money laundering on the platform and stepped down as CEO. President Donald Trump pardoned him in 2025.