TRM Labs links North Korea to $6.36 billion Binance hack
Key points
- TRM Labs attributed the $6.36 billion Binance theft to North Korea's TraderTraitor hacking unit.
- The attacker moved funds across ten blockchains, with most transfers occurring within approximately 20 minutes.
- Crypto industry partners froze approximately $2.7 billion, while the attacker retained substantial Bitcoin and Ethereum holdings.
TRM Labs linked North Korea's TraderTraitor hacking unit to a $6.36 billion theft from Binance on October 29, 2026.
The attacker moved approximately $6.36 billion across ten blockchains, completing most transfers within 20 minutes.
“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence,” RM Labs said in its investigation.
The investigation identified similarities with previous North Korean-linked attacks, including the $1.5 billion Bybit theft in February 2025.
The attacker used Ethereum's EIP-7702 delegation feature and 50 pre-signed authorisations to compromise Binance's hot wallet.
Tether, Circle, Ripple and World Liberty Financial froze approximately $2.67 billion in stolen stablecoins.
The attacker retained more than 420,000 Ethereum (ETH) and 18,270 Bitcoin (BTC), worth approximately $2.4 billion.
The theft places Binance's wallet-signing security and cross-chain withdrawal controls under scrutiny.
Frequently asked questions
More from Crypto
CoinDCX restricts futures trading after liquidity disruption
Uniswap Labs launches TJAR for onchain fee conversion
Avail launches ShieldTX to protect Hyperliquid traders
Binance suspends withdrawals after $6.3 billion security incident
HTX exits UK after settlement with financial regulator
Kalshi raises $1 billion at $40 billion valuation
