TRM Labs links North Korea to $6.36 billion Binance hack
Pontos principais
- TRM Labs attributed the $6.36 billion Binance theft to North Korea's TraderTraitor hacking unit.
- The attacker moved funds across ten blockchains, with most transfers occurring within approximately 20 minutes.
- Crypto industry partners froze approximately $2.7 billion, while the attacker retained substantial Bitcoin and Ethereum holdings.
TRM Labs linked North Korea's TraderTraitor hacking unit to a $6.36 billion theft from Binance on October 29, 2026.
The attacker moved approximately $6.36 billion across ten blockchains, completing most transfers within 20 minutes.
“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence,” RM Labs said in its investigation.
The investigation identified similarities with previous North Korean-linked attacks, including the $1.5 billion Bybit theft in February 2025.
The attacker used Ethereum's EIP-7702 delegation feature and 50 pre-signed authorisations to compromise Binance's hot wallet.
Tether, Circle, Ripple and World Liberty Financial froze approximately $2.67 billion in stolen stablecoins.
The attacker retained more than 420,000 Ethereum (ETH) and 18,270 Bitcoin (BTC), worth approximately $2.4 billion.
The theft places Binance's wallet-signing security and cross-chain withdrawal controls under scrutiny.
