Blockchain analysis firm TRM says N. Korea behind $6.3 bil. Binance crypto theft

U.S. blockchain analysis firm TRM Labs has attributed a $6.3 billion raid on the cryptocurrency exchange Binance to North Korean hackers, specifically identifying the group TraderTraitor. According to TRM Labs, an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, with most of the movement occurring within about 20 minutes. Chainalysis provided a different estimate, stating the amount stolen was approximately $5.912 billion at the time of the theft.

Binance reported on October 30, 2026, that its preliminary investigation suggests the incident may have originated from a compromised laptop belonging to a DevOps engineer, which allowed an attacker to enter a service container and submit unauthorized withdrawal transactions. The company stated it found no evidence of compromised wallet private keys.

While Binance has issued messages stating user funds are safe and that the company will cover all losses through its Secure Asset Fund for Users and company funds, Malay Mail reported the company posted sometimes contradictory messages on X regarding this matter.

As of the reports, Binance has temporarily suspended all deposits and withdrawals to conduct security checks and work with law enforcement. YourStory reported that approximately $3 billion in affected digital assets have been frozen on-chain, while Malay Mail noted the platform indicated more than $2.5 billion had been frozen to prevent theft. Former Binance chief Changpeng Zhao estimated total losses could be slightly higher than $1 billion.

Brief written by urgent.news from The Korea Times, The Korea Times, Euronews, YourStory, Malay Mail — 5 reports on this story. Machine-written — may contain errors; check the original before relying on it.