Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekEduard Kovacs

North Korea’s TraderTraitor linked to $6.36 billion Binance heist

Part of the TraderTraitor story · since 9 Mar

Developinglatest 11 minutes ago13 articles8 outlets
9 Mar · The Hacker News first5 Jul14 Aug23 SepNowThis article11th of 13
  • Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
  • Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
  • Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
  • Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist. This article, 11th of 13.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.

Binance, the world’s largest cryptocurrency exchange, reports a record-breaking crypto heist with initial estimates around $6.3 billion, with on-chain analysts at TRM Labs calculating about $6.36 billion siphoned from Binance wallets across ten blockchains on 29 October 2026. Binance halted withdrawals and said it will reimburse losses using company funds and its Secure Asset Fund for Users (SAFU).

The company’s early findings point to a potentially compromised DevOps engineer’s laptop, which allegedly allowed an attacker to access a service container and submit unauthorised withdrawal transactions; Binance notes there is no evidence of any wallet private key leak.

TRM Labs’ analysis indicates the attackers spent at least 36–40 hours preparing, funding the wallet used to run the operation with small Tornado Cash withdrawals and testing the malicious code on other wallets before going live.

On Ethereum, attackers leveraged EIP-7702 to delegate wallet behaviour to a smart contract, sending 50 pre-signed permissions from a Binance hot wallet so one would match the transaction counter at execution; the wallet was then delegated to a contract controlled by the attackers to drain funds.

TRM and Chainalysis assess the attack as TraderTraitor, North Korea’s elite hacking unit, with similarities to the Bybit and KelpDAO incidents, while entities like ZachXBT and the FBI have linked prior North Korean activity to TraderTraitor. By 00:30 UTC on 30 October, around $2.7 billion in assets were frozen by issuers, with Binance estimating roughly $3 billion frozen in total. The attackers reportedly still hold about $2.4 billion in assets that issuers cannot freeze.

How the story developed

All 13 articles
Developinglatest 11 minutes ago13 articles8 outlets

13 articles from 8 outlets since 9 Mar. Picked up again on 29 Oct after 2 weeks quiet. This was the 11th report, 235 days after the first.

Now9 Mar2528152425 Sep172641119First reportThe Hacker News · 9 Mar, 16:26This article11th of 13 · day 235Picked up againafter 6 weeks quiet
  • Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
  • Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
  • Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
  • Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist. This article, 11th of 13.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 13 articles as a list
  1. Mon 9 MarDay 01
    1. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds16:26 · The Hacker News · First report

  2. Quiet for 6 weeks

    Tue 21 AprDay 432
    1. North Korea linked hackers steal $290M from Kelp DAO DeFi10:21 · SecurityWeek · Picked up again
    2. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit19:27 · Security Affairs

  3. Quiet for 2 days

    Thu 23 AprDay 451
    1. North Korean hackers steal $290m via LayerZero KelpDAO breach15:01 · The Hacker News

  4. Quiet for 8 days

    Fri 1 MayDay 531
    1. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks21:31 · Dark Reading · Picked up again

  5. Quiet for 18 weeks

    Mon 7 SepDay 1821
    1. Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again

  6. Quiet for 2 weeks

    Mon 21 SepDay 1961
    1. Jade Sleet Breach Exposes Backdoors and Rising AI Threats06:21 · The Hacker News · Picked up again

  7. Quiet for 7 days

    Mon 28 SepDay 2031
    1. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests02:30 · SecurityOnline · Picked up again

  8. Quiet for 2 weeks

    Mon 12 OctDay 2171
    1. Fake Terraform AWS provider installs backdoors on developer systems09:11 · SecurityOnline · Picked up again

  9. Quiet for 2 weeks

    Thu 29 OctDay 2341
    1. Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again
  10. Fri 30 OctDay 2353
    1. North Korea’s TraderTraitor linked to $6.36 billion Binance heist08:30 · SecurityWeek · This article, 11th of 13
    2. Binance probe traces $6.36 billion hack to DevOps breach09:00 · SecurityOnline
    3. Binance reports $6.3 billion theft from its hot wallets09:30 · SOCRadar

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in