Security AffairsPierluigi Paganini
TRM Labs attributes $6.3 billion Binance theft to North Korea
Part of the TraderTraitor story · since 9 Mar
- Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
- Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
- Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
- Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
- Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
- Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
- Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
- Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
- Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
- Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
- Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
- Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
- Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
- Fri 30 Oct, 12:00 UTC. Infosecurity. Analysts attribute Binance’s $6.3bn hack to North Korean group.
- Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
- Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
- Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea. This article, 17th of 17.
Binance is investigating a crypto theft that the company says involved movements totalling about USD 6.3 billion, with blockchain analysts attributing the attack to North Korea’s TraderTraitor unit (also tracked as Lazarus Group and APT38). Binance initially reported suspicious transfers valued up to USD 5.8 billion and said customer funds remained safe, while co-founder Changpeng Zhao described the activity as a hack.
Binance added that its security teams were reviewing relevant information and that deposits and withdrawals across several networks were suspended during the investigation.
TRM Labs states that around USD 6.36 billion was moved from Binance wallets on ten blockchains, predominantly within about 20 minutes starting at 20:05 UTC on 29 October 2026, making it one of the largest crypto thefts on record. TRM attributes the breach to TraderTraitor, noting robust on- and off-chain intelligence and that the firm is tracking the funds via the Beacon Network. Chainalysis also said it had a high degree of confidence that DPRK actors were responsible.
Initial freezes by issuers and intermediaries froze roughly USD 2.7 billion in various stablecoins and assets, though attackers reportedly accelerated moves by selling USDT and borrowing against it. Investigators are assessing how attackers gained access, whether wallets were compromised, and whose funds were stolen, while Binance said it would cover losses using its SAFU fund and company resources and publish a refreshed Proof of Reserves after recovery work.
How the story developed
17 articles from 10 outlets since 9 Mar. Picked up again on 29 Oct after 2 weeks quiet. This was the 17th report, 235 days after the first.
- Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
- Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
- Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
- Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
- Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
- Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
- Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
- Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
- Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
- Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
- Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
- Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
- Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
- Fri 30 Oct, 12:00 UTC. Infosecurity. Analysts attribute Binance’s $6.3bn hack to North Korean group.
- Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
- Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
- Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea. This article, 17th of 17.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 17 articles as a listHide the list
- Mon 9 MarDay 01
- North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds16:26 · The Hacker News · First report
Quiet for 6 weeks
Tue 21 AprDay 432- North Korea linked hackers steal $290M from Kelp DAO DeFi10:21 · SecurityWeek · Picked up again
- Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit19:27 · Security Affairs
Quiet for 2 days
Thu 23 AprDay 451- North Korean hackers steal $290m via LayerZero KelpDAO breach15:01 · The Hacker News
Quiet for 8 days
Fri 1 MayDay 531- North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks21:31 · Dark Reading · Picked up again
Quiet for 18 weeks
Mon 7 SepDay 1821- Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again
Quiet for 2 weeks
Mon 21 SepDay 1961- Jade Sleet Breach Exposes Backdoors and Rising AI Threats06:21 · The Hacker News · Picked up again
Quiet for 7 days
Mon 28 SepDay 2031- North Korean Hackers Hide macOS Backdoors in Fake Coding Tests02:30 · SecurityOnline · Picked up again
Quiet for 2 weeks
Mon 12 OctDay 2171- Fake Terraform AWS provider installs backdoors on developer systems09:11 · SecurityOnline · Picked up again
Quiet for 2 weeks
Thu 29 OctDay 2341- Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again
- Fri 30 OctDay 2357
- North Korea’s TraderTraitor linked to $6.36 billion Binance heist08:30 · SecurityWeek
- Binance probe traces $6.36 billion hack to DevOps breach09:00 · SecurityOnline
- TRM Labs attributes $6.3 billion Binance theft to North Korea19:30 · Security Affairs · This article, 17th of 17
Show 4 more from 30 Oct
- Binance reports $6.3 billion theft from its hot wallets09:30 · SOCRadar
- Analysts attribute Binance’s $6.3bn hack to North Korean group12:00 · Infosecurity
- Binance reports $6.3 billion theft linked to North Korean group13:00 · Malwarebytes
- TRM Labs links record $6.3 billion Binance heist to North Korea14:30 · Ars Technica