North Korea link suspected in Binance hack
Blockchain investigators say the theft bears the hallmarks of earlier attacks linked to Pyongyang.
Follow-up to: Binance suspends withdrawals after suspected hack; £4.8bn loss unconfirmed Friday, 30 October 2026, 07:05
Two blockchain intelligence firms have linked the $6.3bn Binance breach to North Korea. Reuters, citing a person familiar with the situation, reported that Binance was working with law-enforcement agencies, including the FBI and US Secret Service, while investigating how the attack happened.
TRM Labs said the attack showed characteristics associated with TraderTraitor, a North Korean hacking unit. Chainalysis separately said the theft was likely carried out by the same group. Both assessments are based on the movement of cryptocurrency across several blockchains rather than on a public admission by North Korea.
TRM said about $6.36bn in digital assets had been moved from Binance wallets across ten blockchains, with most of the transfers taking place within roughly 20 minutes. The amount moved does not establish the final value of the theft. TRM's figure is an estimate of the value of the assets moved.
Binance has said that its initial investigation pointed to a compromised laptop belonging to a DevOps engineer. It later said investigators had identified additional points of breach. The company said deposits were unaffected, while withdrawals remained suspended and were expected to resume within a day or two.
The exchange said it was working with partners to freeze about $3bn of the affected assets and had begun recovering assets for users. Binance also said it would cover losses. Those statements concern the company’s response; they do not establish the final amount stolen or explain whether every affected asset can be recovered.
Reuters, citing a person familiar with the situation, reported that Binance was working with the FBI and US Secret Service, as well as other law-enforcement agencies. A Binance spokesperson said the company was working with law-enforcement partners to identify the criminals and bring them to justice.
North Korean-linked groups have previously been accused of stealing cryptocurrency to generate funds for the state. The FBI has attributed earlier attacks, including the $1.5bn theft from Bybit last year, to North Korea and TraderTraitor. The new attribution remains an intelligence assessment, not a court finding.
Also show where in Europe and in the world
Fact-check Approved · Priya Shah — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article separates confirmed company statements from intelligence assessments. The financial figure, recovery efforts and US agency involvement are supported by the cited reports.
- confirmed About $6.36bn was moved from Binance wallets across ten blockchains. — Reported by TRM Labs through Associated Press. source
- confirmed Blockchain intelligence firms linked the attack to TraderTraitor. — AP reports assessments by TRM Labs and Chainalysis. source
- confirmed Binance was working with the FBI and US Secret Service. — Reuters attributed the information to a person familiar with the situation. source
Editor's note
The breach, suspended withdrawals and law-enforcement involvement are reported. The North Korean attribution is based on blockchain-intelligence assessments and remains unproven.Sources
The story so far
- Friday, 30 October 2026, 07:05 Binance suspends withdrawals after suspected hack; £4.8bn loss unconfirmed
- Friday, 30 October 2026, 18:03 North Korea link suspected in Binance hack (this article)
More on this in other media
- The Guardian — „binance cryptocurrency”
- BBC News — „binance cryptocurrency”
- Sky News — „binance cryptocurrency”