Binance’s $6.3 B Hack Attributed to North Korean TraderTraitor Group
Current overview (not historical)
Researchers have attributed Binance’s record $6.3 billion crypto theft to the North Korean TraderTraitor organization with high confidence. According to ZachXBT, the stolen funds were moved via THORChain before being mixed at the same address. Binance confirmed that roughly $6.3 billion was affected and that about $3 billion of assets have been frozen. The attribution is based on forensic analysis of transaction flows and aligns with the group’s known tactics, but the full scope of the breach and the ultimate destination of the remaining assets remain unclear.
Written with AI from the reporting · updated 10/30/2026
Related events
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 30, 00:00recorded Oct 30, 14:16single sourcerevised
北韩TraderTraitor组织被指控6.3亿美元Binance黑客攻击
Read original source ↗ CointelegraphReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- trader-traitor
- Action：
- 被指控
- Object：
- Binance黑客攻击
- Occurred (fact side)：
- Oct 30, 00:00
- Published (valid side)：
- Oct 30, 13:51
- First seen (known side)：
- Oct 30, 14:16
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
- 2Unclassified fact stationOct 29, 00:00recorded Oct 30, 15:55single sourcerevised
Binance $6.3B hack linked to North Korea's TraderTraitor
Read original source ↗ CointelegraphReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- binance
- Action：
- security breach involving compromised DevOps engineer's laptop
- Object：
- access service container and submit unauthorized withdrawal transactions
- Occurred (fact side)：
- Oct 29, 00:00
- Published (valid side)：
- Oct 30, 15:33
- First seen (known side)：
- Oct 30, 15:55
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- CointelegraphSelectedRelated fact: single sourceSource report revisedBinance Reports $6.3 B Loss After North Korean‑Linked Hacker Group TraderTraitor Steals Crypto
Report first recorded Oct 30, 15:55
Binance says the hack has cost the exchange roughly $6.3 billion, with about $3 billion of cryptocurrency already frozen. The stolen assets include USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP and ARB. Chainalysis, TRM Labs, Blockaid and other security firms point to the North Korean hacking group TraderTraitor as the likely culprit, a group also linked to the ByBit and Kelp DAO attacks. Binance has paused withdrawals while it revamps its security, but deposits remain active and withdrawals are expected to resume within 48 hours. The incident has prompted speculation that the breach could accelerate a shift from centralized exchanges to decentralized platforms such as Uniswap.
Read original source ↗ - CointelegraphSelectedRelated fact: single sourceSource report revisedNorth Korea’s TraderTraitor Group Linked to $6.3 B Binance Hack
Report first recorded Oct 30, 14:16
Cybersecurity firms TRM Labs and Chainalysis, together with on‑chain investigator ZachXBT, have attributed the $6.3 B theft from Binance to the North Korean hacker collective TraderTraitor. TRM Labs cited both on‑chain and off‑chain intelligence to reach a “high confidence” attribution. ZachXBT noted that the stolen Binance funds and those taken in the earlier Bitget exploit were commingled at the same address after moving through THORChain, indicating a single actor behind both incidents. Chainalysis CEO Jonathan Levin estimated the loss at $6.4 B and linked it to TraderTraitor, citing similarities to previous North Korean‑linked hacks such as the Bybit and DMM Bitcoin thefts. The FBI has also identified TraderTraitor as the culprit in the $300 M DMM Bitcoin robbery, where an attacker used social engineering to gain employee access and divert funds. The attribution underscores a pattern of cross‑platform, state‑backed cyber‑criminal activity.
Read original source ↗
Event activity trend
- Latest comparable
- 3
- Comparable peak
- 10Oct 30, 16:00
- 24h change
- -51%
The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.