Ars TechnicaNikou Asgari, Financial Times
TRM Labs links record $6.3 billion Binance heist to North Korea
Part of the TraderTraitor story · since 9 Mar
- Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
- Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
- Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
- Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
- Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
- Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
- Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
- Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
- Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
- Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
- Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
- Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
- Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
- Fri 30 Oct, 12:00 UTC. Infosecurity. Analysts attribute Binance’s $6.3bn hack to North Korean group.
- Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
- Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea. This article, 16th of 16.
Binance says it has suspended withdrawals after what it calls the world’s largest crypto heist, with an estimated total impact of about $6.3 billion. The exchange disclosed that roughly $3 billion of the affected assets, largely stablecoins used as cash in the market, have been frozen. Analysts from Elliptic, however, contend the attacker converted about $3.3 billion into digital assets that cannot be frozen and is attempting to cash them out as traditional currency.
Binance’s initial investigations point to the compromise of an engineer’s laptop as a route into the system, with the firm later noting additional breach points. The company stressed it is cooperating with law enforcement.
The incident has been linked by TRM Labs to a North Korean unit known as TraderTraitor, a claim echoed by the Financial Times’ reporting partner. Binance has announced it has reserved over $6.34 billion to cover the losses, with about $5 billion held in the exact token assets that were impacted. It said it is actively buying more tokens to close the remaining gap, though liquidity constraints may slow settlement. There is no shown evidence that user private keys were compromised.
The turmoil comes as Binance faces a tightened regulatory backdrop, including Abu Dhabi regulation and EU restrictions, while the broader market experienced a sharp move in Bitcoin and ongoing volatility across digital assets.
How the story developed
16 articles from 10 outlets since 9 Mar. Picked up again on 29 Oct after 2 weeks quiet. This was the 16th report, 235 days after the first.
- Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
- Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
- Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
- Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
- Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
- Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
- Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
- Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
- Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
- Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
- Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
- Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
- Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
- Fri 30 Oct, 12:00 UTC. Infosecurity. Analysts attribute Binance’s $6.3bn hack to North Korean group.
- Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
- Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea. This article, 16th of 16.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 16 articles as a listHide the list
- Mon 9 MarDay 01
- North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds16:26 · The Hacker News · First report
Quiet for 6 weeks
Tue 21 AprDay 432- North Korea linked hackers steal $290M from Kelp DAO DeFi10:21 · SecurityWeek · Picked up again
- Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit19:27 · Security Affairs
Quiet for 2 days
Thu 23 AprDay 451- North Korean hackers steal $290m via LayerZero KelpDAO breach15:01 · The Hacker News
Quiet for 8 days
Fri 1 MayDay 531- North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks21:31 · Dark Reading · Picked up again
Quiet for 18 weeks
Mon 7 SepDay 1821- Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again
Quiet for 2 weeks
Mon 21 SepDay 1961- Jade Sleet Breach Exposes Backdoors and Rising AI Threats06:21 · The Hacker News · Picked up again
Quiet for 7 days
Mon 28 SepDay 2031- North Korean Hackers Hide macOS Backdoors in Fake Coding Tests02:30 · SecurityOnline · Picked up again
Quiet for 2 weeks
Mon 12 OctDay 2171- Fake Terraform AWS provider installs backdoors on developer systems09:11 · SecurityOnline · Picked up again
Quiet for 2 weeks
Thu 29 OctDay 2341- Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again
- Fri 30 OctDay 2356
- North Korea’s TraderTraitor linked to $6.36 billion Binance heist08:30 · SecurityWeek
- Binance probe traces $6.36 billion hack to DevOps breach09:00 · SecurityOnline
- TRM Labs links record $6.3 billion Binance heist to North Korea14:30 · Ars Technica · This article, 16th of 16
Show 3 more from 30 Oct
- Binance reports $6.3 billion theft from its hot wallets09:30 · SOCRadar
- Analysts attribute Binance’s $6.3bn hack to North Korean group12:00 · Infosecurity
- Binance reports $6.3 billion theft linked to North Korean group13:00 · Malwarebytes