Two blockchain intelligence firms say North Korea’s elite hacking unit stole about $6.36 billion from the cryptocurrency exchange Binance, which would make it the largest crypto theft on record. No government has publicly confirmed the attribution, and Binance has not confirmed it either.
What is established
TRM, a U.S.-based blockchain intelligence firm, said an attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes. TRM posted its findings on Thursday, and the Associated Press reported them on Friday, October 30, 2026. The AP rounded the loss to “more than $6 billion.”
Binance says it worked with blockchain partners to freeze roughly $3 billion in affected assets. The exchange says customer deposits were unaffected, withdrawals are suspended and should resume within a day or two, and it will cover all losses.
Who is blamed, and on what evidence
TRM attributed the theft to TraderTraitor, which it described as North Korea’s elite hacking unit, and said it made that judgment “with high confidence.” The evidence it cited is a pattern: “Several features of this attack match earlier North Korea-linked heists, including the Bybit hack.”
Jonathan Levin, co-founder and chief executive of the firm Chainalysis, wrote on X that the theft was “likely done by DPRK group TraderTraitor.” DPRK stands for the Democratic People’s Republic of Korea, North Korea’s formal name. The AP’s account gives no further evidence from Chainalysis.
The Bybit comparison is worth separating from this case. The Federal Bureau of Investigation (FBI) said North Korea and TraderTraitor were responsible for the February 2025 theft of $1.5 billion from the Bybit exchange. That was a government finding about a different theft. For Binance, the AP reports no FBI or other government attribution. A match with earlier heists is a reason for suspicion, and “high confidence” is a private firm’s judgment, not a legal finding.
What Binance has said, and how its account has shifted
A Binance spokesperson, asked about the North Korea link, said only that the company is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.”
On X, Binance first said its initial investigation suggested the incident may have involved a compromised laptop. A later investigation, it said, uncovered additional “points of breach.” Binance also said it found no evidence of any wallet private key leak, and that it will release more technical details when its investigation is complete.
Changpeng Zhao, Binance’s founder, who stepped down as chief executive in 2023 and was pardoned by President Donald Trump in 2025, posted on X: “User funds are safe!” He said the theft “does look like a hack on Binance” and that, as a shareholder, he expects all user funds to be fully covered.
A competing theory, flagged as speculation
Kok Tin Gan, chief executive of the security firm NyxLab, offered a different reading. “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,” he said. That is his speculation, not a confirmed finding, and it sits uneasily with Binance’s statement that it found no private key leak. Which account is right is not yet known.
What is not yet confirmed
The AP report does not give a calendar date for the theft. It does not establish how the attacker got in, how much of the remainder beyond the roughly $3 billion frozen can be recovered, or whether any government will formally name North Korea. Binance’s promise to resume withdrawals within a day or two is also a statement of intent, not a completed fact.
Why it matters
If a government confirms the attribution, this would be the second large exchange theft pinned on TraderTraitor, after Bybit. It would also raise a practical question for U.S. officials about whether exchange security standards have kept pace with a state-backed adversary that has now been tied to two of the biggest thefts in the industry’s history. For now, that is a conditional: the proof so far is a firm’s pattern analysis and Binance’s own incomplete account.
Sources
- Associated Press, via The Philadelphia Inquirer: “Blockchain intelligence firms link North Korea to $6.3B hack on Binance” (October 30, 2026)
- Statements from TRM, Chainalysis, Binance, Changpeng Zhao and NyxLab are as quoted by the Associated Press. Right Side News did not independently review the original TRM post.
- Featured image: Flag of North Korea (public domain flag design), from the Right Side News media library.
How this article was made: Right Side News researched and drafted this article with the help of AI tools. Sources are linked so readers can check them. Spot an error? Tell us in the comments and we will correct it.