The TraderTraitor hacking unit from the Democratic People’s Republic of Korea (DPRK) – also known as North Korea – is behind the $6.3 billion attack on the cryptocurrency exchange Binance, per the report published by the blockchain intelligence and AI investigation company TRM on October 29.
According to the announcement, the hack began approximately 36 hours earlier when the attacker’s operator wallet received three small withdrawals from the digital assets mixer Tornado Cash.
The group also rehearsed the attack on two wallets by deploying code the group would be using early on October 29 and then installed the same code on a Binance hot wallet. TRM also claims that the first earnest theft occurred on the XRP Ledger when five Binance wallets sent 233.46 million XRP to a single attacker address.
Advertisement
Additionally, the publication briefly outlines how the North Korean unit managed to take control of a hot wallet belonging to the world’s biggest cryptocurrency exchange, and alleged the company’s signing infrastructure was used.
Lastly, TRM highlighted that more information will be published as its investigation progresses, but disclosed it managed to link the event with TraderTrator using ‘robust on and off-chain intelligence sources.’
The same North Korean group was behind the $1.5 billion Bybit attack
Notably, the unit from DPRK was named by the Federal Bureau of Investigation (FBI) as the group responsible for the $1.5 billion Bybit hack that took place early in 2025.
TRM likewise highlighted the similarities between the attack on Binance and others perpetrated by North Korea:
Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit.
Binance claims users’ funds are safe, pledges to cover all losses
Meanwhile, the Binance hack appears to be the largest cryptocurrency robbery ever recorded and stole more than $6.3 billion. For comparison, a Finbold Research article published early in October indicates that, for the entire third quarter (Q3) of 2026, roughly $1.17 billion was taken.
Advertisement
Still, despite the scale, the exchange pledged to cover all losses from the attack and has frozen more than $2 billion worth of assets, while other digital asset firms also deployed measures designed to make fully extracting the funds more difficult.
Binance also boasts a ‘SAFU’ fund built for such emergencies – though, notably, it contained only roughly $1.1 billion worth of Bitcoin (BTC) on the morning of Friday, October 30 – and founder Changpeng Zhao (CZ) floated the idea of using the firm’s SpaceX (NASDAQ: SPCX) stock stake to cover some of the losses.
Featured image via Shutterstock
