Skip to content
OriginalSign in

Infosecurity

Analysts attribute Binance’s $6.3bn hack to North Korean group

Part of the TraderTraitor story · since 9 Mar

Developinglatest 3 minutes ago15 articles9 outlets
9 Mar · The Hacker News first5 Jul14 Aug23 SepNowThis article14th of 15
  • Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
  • Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
  • Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
  • Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity. Analysts attribute Binance’s $6.3bn hack to North Korean group. This article, 14th of 15.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.

Binance says it has suffered the largest cyber-attack in history, with about $6.3 billion of cryptocurrency stolen. The exchange initially indicated the entry point may have been a compromised DevOps engineer’s laptop, which allegedly allowed access to a service container and unauthorized withdrawal transactions. Subsequent updates noted that the breach was more complex than first thought and that additional breach points had been identified as the investigation progressed.

Binance has not provided a definitive, final account and plans a comprehensive technical post-mortem once the inquiry is complete, while stressing that there is no evidence of leaked wallet private keys and that customer funds are safe for now. The firm has frozen around $3 billion of the stolen funds and says it will cover losses through its Secure Asset Fund for Users (SAFU) and company funds, and it aims to publish an updated proof of reserves after remediation.

Analysts from TRM Labs, Elliptic and Chainalysis have attributed the attack, with “high confidence”, to TraderTraitor, a North Korean hacking group. In response to the incident, Binance suspended deposits, withdrawals and several Alpha trading activities, later resuming deposits while withdrawals remained paused for a security revamp of the withdrawal service and related addresses.

Withdrawals are expected to resume within 45 hours, and Binance continues to work with law enforcement and blockchain partners to trace and freeze affected assets. The exchange has warned customers to ignore unofficial links or requests for information and to rely on official channels for updates.

How the story developed

All 15 articles
Developinglatest 3 minutes ago15 articles9 outlets

15 articles from 9 outlets since 9 Mar. Picked up again on 29 Oct after 2 weeks quiet. This was the 14th report, 235 days after the first.

Now9 Mar2528152425 Sep172641119First reportThe Hacker News · 9 Mar, 16:26This article14th of 15 · day 235Picked up againafter 6 weeks quiet
  • Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
  • Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
  • Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
  • Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity. Analysts attribute Binance’s $6.3bn hack to North Korean group. This article, 14th of 15.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 15 articles as a list
  1. Mon 9 MarDay 01
    1. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds16:26 · The Hacker News · First report

  2. Quiet for 6 weeks

    Tue 21 AprDay 432
    1. North Korea linked hackers steal $290M from Kelp DAO DeFi10:21 · SecurityWeek · Picked up again
    2. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit19:27 · Security Affairs

  3. Quiet for 2 days

    Thu 23 AprDay 451
    1. North Korean hackers steal $290m via LayerZero KelpDAO breach15:01 · The Hacker News

  4. Quiet for 8 days

    Fri 1 MayDay 531
    1. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks21:31 · Dark Reading · Picked up again

  5. Quiet for 18 weeks

    Mon 7 SepDay 1821
    1. Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again

  6. Quiet for 2 weeks

    Mon 21 SepDay 1961
    1. Jade Sleet Breach Exposes Backdoors and Rising AI Threats06:21 · The Hacker News · Picked up again

  7. Quiet for 7 days

    Mon 28 SepDay 2031
    1. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests02:30 · SecurityOnline · Picked up again

  8. Quiet for 2 weeks

    Mon 12 OctDay 2171
    1. Fake Terraform AWS provider installs backdoors on developer systems09:11 · SecurityOnline · Picked up again

  9. Quiet for 2 weeks

    Thu 29 OctDay 2341
    1. Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again
  10. Fri 30 OctDay 2355
    1. North Korea’s TraderTraitor linked to $6.36 billion Binance heist08:30 · SecurityWeek
    2. Binance probe traces $6.36 billion hack to DevOps breach09:00 · SecurityOnline
    3. Analysts attribute Binance’s $6.3bn hack to North Korean group12:00 · Infosecurity · This article, 14th of 15
    Show 2 more from 30 Oct
    1. Binance reports $6.3 billion theft from its hot wallets09:30 · SOCRadar
    2. Binance reports $6.3 billion theft linked to North Korean group13:00 · Malwarebytes

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in