On-chain Finance · Latest

North Korean Lazarus Group Linked to $6.3 bn Binance Hack

Two blockchain analytics firms, TRM Labs and Chainalysis, have identified the North Korean state‑backed Lazarus Group (also known as TraderTraitor) as the likely perpetrators of the $6.3 bn (£4.7 bn) theft from Binance, the world’s largest cryptocurrency exchange. The group reportedly gained access to Binance’s hot‑wallet signing system, enabling automated transfers of funds. Binance’s co‑CEO Richard Teng said the breach was broader than an engineer’s laptop compromise and that about 80 % of the stolen assets have been recovered, with the remainder still missing. The incident follows a series of high‑profile cyber‑attacks attributed to North Korea, including the 2014 Sony Pictures hack and the 2022 theft of $620 m in crypto from Bybit, and underscores the country’s use of cybercrime to finance its regime.

Binance Hackers Convert $6.3 B in Stolen Crypto Before Authorities Freeze Assets

The largest crypto‑world theft began at 8:04 pm UTC Thursday when attackers linked to the North Korean group behind last month’s Bitget hack seized roughly $6.3 B in cryptocurrency from Binance. They immediately moved the stolen stablecoins—USDT and USDC, which can be frozen by their issuers—into non‑frozen assets such as BTC and ETH. Within an hour, $500 M of USDT had been sent to a single address, and $325 M was sold for ETH by 20:59 UTC. Stablecoin issuers Tether and Circle, along with other entities, began blacklisting the attackers’ addresses within minutes, freezing about $1.567 B in USDT and $823 M in USDC. Binance reported that around $3 B of the stolen funds were on‑chain frozen, and it is collaborating with law enforcement, issuers and blockchain analytics firms to trace the remaining assets. Decentralized protocols also acted: Arbitrum’s Security Council moved $30.5 M in ARB and ETH into a frozen wallet, and Aave V3 saw a $60 M USDT deposit from an attacker‑linked wallet. While freezing stops the attackers from spending the assets, it does not automatically recover them for Binance or its users.

Binance Hackers Employ Unprecedented Laundering Tactics to Hide $6.3 Billion Theft

Hackers who stole $6.3 billion from Binance are using a new, automated laundering strategy to move the funds. Chainalysis identified thousands of rapid, repetitive transactions that circulate stolen assets among a dense network of wallets, often returning funds to earlier addresses to create a complex trail. The attackers converted roughly $786 million of stolen stablecoins into Ethereum and Tron before regulatory freezes, accepting significant price slippage to speed the process. Elliptic reports that the thieves sold about 434 million USDT for 160,451 ETH on Uniswap and 1inch at 12‑26% below market rates, and swapped 234 million USDT for 638 million TRX on SunSwap. These conversions consolidate the assets into native cryptocurrencies that cannot be directly frozen, while a separate route was used for 18,270 BTC. The speed, automation, and cross‑chain swaps create a new laundering pattern that complicates blockchain investigations.

Binance, FBI and Secret Service Investigate $6.4 B Hack, Circle and Tether Freeze $1.8 B in Stablecoins

Binance is collaborating with the FBI and the U.S. Secret Service after a hacking incident that stole $6.4 billion from the exchange. Circle’s CEO Jeremy Allaire said the company has frozen roughly $823 million in USDC linked to the attack, while Tether has frozen about $975.1 million in USDT. Blockchain analytics firms TRM Labs and Chainalysis attribute the breach to the North Korean group TraderTraitor, previously tied to the $1.5 billion Bybit hack. The coordinated freeze of more than $1.8 billion in stablecoins demonstrates how issuers can block stolen digital assets before they are moved, aiding law‑enforcement investigations worldwide.

Binance Seizes $3 bn of $6.3 bn Stolen in North Korea‑Linked Hack

Binance, the world’s largest crypto exchange, has frozen roughly $3 bn of the $6.3 bn ($4.7 bn) it says was siphoned off in a sophisticated hack that analysts link to a North Korean cyber‑crime unit. The exchange initially blamed a compromised engineer’s laptop but later confirmed a broader breach. U.S. authorities, including the Secret Service, FBI and the Treasury’s Financial Crimes Enforcement Network, are working to trace, freeze and recover the remaining stolen funds. Binance has assured users that their money is safe and that it will cover all losses, while also maintaining that deposits remain unaffected. The incident eclipses the $1.5 bn Bybit heist of 2025 and underscores the growing threat of state‑backed hacking in the crypto market.

Binance Loses $6.4 B in North‑Korean Hack, Users Covered by SAFU Fund

A North‑Korean hacker group stole roughly $6.4 B from Binance, the largest crypto theft ever, by compromising a DevOps engineer’s laptop. The stolen assets were spread across three blockchains: about $3.5 B in ETH, $1.4 B in BTC and $630 M on Tron. Stable‑coin issuers Tether and Circle used their built‑in freeze mechanisms to lock about $2.39 B, leaving $2.6‑$3.2 B still unaccounted for. Binance announced it had set aside $6.34 B from its SAFU fund to fully cover user losses and stated that user funds are “completely safe.” Aave also froze its V3 and V4 markets on Ethereum to prevent the attacker from using the stolen funds to create bad debt. The incident caused Bitcoin to dip below $77.5 k, ETH under $2,200, and BNB under $700, with over $1.33 B in positions liquidated.

TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor

Binance Loses $6.15 Billion in 31 Minutes as Hackers Exploit EIP‑7702 Authorization

On October 29, 2026, an attacker drained approximately $6.15 billion from Binance’s hot wallets across nine blockchains in just 31 minutes. The theft did not involve stolen private keys; instead, the attacker leveraged Binance’s own authorization system, specifically the EIP‑7702 feature that allows a smart contract to act on a wallet’s behalf. Prior to the attack, the attacker funded their wallets via Tornado Cash to obscure the source of funds and conducted two rehearsals on their own wallets to test a custom smart‑contract draining tool. The final version of the tool could execute arbitrary calls on delegated wallets, enabling the attacker to command a Binance smart wallet to release 823 million USDC. The incident highlights a critical vulnerability in Binance’s hot‑wallet management and the broader risks of permission‑based smart‑contract interactions in cryptocurrency exchanges.

Binance Reports $6.3 B Loss After North Korean‑Linked Hacker Group TraderTraitor Steals Crypto

Binance says the hack has cost the exchange roughly $6.3 billion, with about $3 billion of cryptocurrency already frozen. The stolen assets include USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP and ARB. Chainalysis, TRM Labs, Blockaid and other security firms point to the North Korean hacking group TraderTraitor as the likely culprit, a group also linked to the ByBit and Kelp DAO attacks. Binance has paused withdrawals while it revamps its security, but deposits remain active and withdrawals are expected to resume within 48 hours. The incident has prompted speculation that the breach could accelerate a shift from centralized exchanges to decentralized platforms such as Uniswap.

North Korea’s TraderTraitor Group Linked to $6.3 B Binance Hack

Cybersecurity firms TRM Labs and Chainalysis, together with on‑chain investigator ZachXBT, have attributed the $6.3 B theft from Binance to the North Korean hacker collective TraderTraitor. TRM Labs cited both on‑chain and off‑chain intelligence to reach a “high confidence” attribution. ZachXBT noted that the stolen Binance funds and those taken in the earlier Bitget exploit were commingled at the same address after moving through THORChain, indicating a single actor behind both incidents. Chainalysis CEO Jonathan Levin estimated the loss at $6.4 B and linked it to TraderTraitor, citing similarities to previous North Korean‑linked hacks such as the Bybit and DMM Bitcoin thefts. The FBI has also identified TraderTraitor as the culprit in the $300 M DMM Bitcoin robbery, where an attacker used social engineering to gain employee access and divert funds. The attribution underscores a pattern of cross‑platform, state‑backed cyber‑criminal activity.

Binance hack may involve compromised signing infrastructure, not stolen keys, says Blockaid

Blockaid co-founder Ido Ben-Natan told Cointelegraph that the suspected $2.5 billion-plus Binance hack likely involved manipulation of the exchange's transaction-signing system rather than theft of private keys. The analysis points to "key misuse," where attackers authorized malicious transactions by compromising signing infrastructure. Blockaid's onchain analysis identified 50 EIP-7702 authorizations bundled into one transaction, one of which matched the account's required nonce. The affected account was delegated to an unverified sweeper contract allowing token drainage. Ben-Natan noted similarities to the February 2025 Bybit attack, which also involved compromised developer credentials.

Tether, Circle, Ripple and World Liberty Financial freeze $2.6 billion linked to suspected Binance breach

Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial froze over $2.6 billion in digital assets tied to a suspected Binance security breach involving nearly $6 billion in outflows. Tether froze $1.567 billion in USDT and Circle froze $823 million in USDC. Ripple froze $200 million and World Liberty Financial restricted $27 million. The freezes followed Kairos Research estimating about $5.7 billion leaving Binance hot wallets via a security breach in late October.

Binance hacker uses Uniswap and Aave to swap frozen stablecoins for ETH

Binance hacker wallets drained at least $5.5 billion, with about 253,000 ETH ($570 million) held in two wallets without outgoing transfers as of 22:07 UTC. The attacker swapped stablecoins on Uniswap and borrowed ETH on Aave, exploiting the fact that ETH has no issuer that can freeze funds, unlike stablecoins. Ripple froze $200 million in RLUSD, while Tether and Circle blacklisted attacker addresses, freezing over $2 billion in USDT and USDC. Aave froze its V3 markets on Ethereum mainnet, and Kamino paused Solana and Bitcoin markets as a precaution.

Binance Reports $6.3 B Impact from Unauthorized Withdrawals, Covers Losses

Binance says a security incident involving unauthorized withdrawals has caused an estimated $6.3 billion in total impact, with about $3 billion frozen on‑chain so far. The exchange claims it will cover all losses from its SAFU fund and company funds, and user funds are safe. Deposits and withdrawals are suspended while the investigation continues. Circle and Tether have frozen roughly $823 m and $971 m of stablecoins tied to the incident. On‑chain analysis links the Binance exploit to the $388 m Bitget hack, suggesting a common attacker. Binance’s initial investigation points to a compromised DevOps engineer’s laptop that allowed unauthorized service‑container access, with no evidence of a private‑key leak.

Binance wallets drained of $5.57 billion in suspected hack, Tether and Circle freeze $1.8 billion

At least $5.57 billion left Binance-linked wallets across Ethereum, Bitcoin and Tron on Thursday, in what appears to be the largest crypto hack on record. Tether froze 975.1 million USDT and Circle froze 823 million USDC in the main receiving wallet, bringing total frozen assets to about $1.8 billion. Bitcoin fell below $79,000 and BNB dropped about 7% as the market reacted.

Binance confirms largest crypto hack in history, $5.5 billion traced from hot wallets

Blockchain investigators traced up to $5.5 billion in suspicious transfers from Binance hot wallets on Thursday. Tether froze over $1.567 billion in USDT and Circle froze over $800 million in USDC. Security researchers suspect attackers exploited the Ethereum feature EIP-7702 to gain control of a Binance wallet, submitting 50 signed authorizations before successfully draining approximately 167,464 ETH and 1.615 billion USDT. Both Binance exchange withdrawals and Binance Alpha trading remain suspended.

X100 governance flaws trigger $6M loss via flash loan attack

An attacker acquired two governance seats on X100 by freezing 19,000 tokens under a one-year lock, then executed proposal 7 in a single transaction to transfer 400,000 treasury tokens to an attacker-controlled pool. The attacker swapped tokens for cash to repay a flash loan of approximately 1.94 million USDT, leaving about 4.75 million USDT for three recipients after ChainBounty reconciliation. Separately, at Arkadiko, a malicious contract gained vault authority after a five-day vote ended two days early, allowing the proposal to execute immediately after late token purchases.

SpaceX secures $40 billion GPU lease from Apollo, Musk warns of neocloud consolidation

SpaceX signed a binding commitment for approximately $40 billion in GPU leases from an Apollo-managed entity, with leases starting in the first half of 2027 and the master lease expected to close before the end of 2026. Elon Musk warned that debt markets have largely cut off funding for companies without substantial revenue outside AI data centers, predicting "guppy-level death and consolidation" among the 200+ neoclouds. SpaceX, which recently absorbed xAI, stated it is investment grade and has revenue from Starlink and rocket launches independent of AI.

Ukraine’s battlefield relies on Starlink as EU’s Iris² network remains years away

Ukraine’s military and civilians depend on Elon Musk’s Starlink satellite internet for real‑time communications and drone operations. A sudden slowdown last week exposed the vulnerability of relying on a single US‑based provider. Alternatives such as France’s Eutelsat/OneWeb constellation, with only about 600 active satellites, lag far behind Starlink’s 10,000‑plus network. The EU is developing a rival system, Iris², but it is not expected to be operational until 2029. Until then, Ukraine can only tap into the EU’s Govsatcom sharing network, which cannot support military‑grade tasks like drone control. Musk warned that cutting Starlink would collapse the Ukrainian front line, highlighting the strategic importance of satellite connectivity in modern warfare.

Solana wallet generates $1.4 billion in suspected wash trading on Raydium

A single Solana wallet accounted for 22.7% of Raydium's concentrated liquidity volume, generating $1.4 billion in trading from just $12,000 in working capital. Blockchain analytics firm Bitquery identified 108,871 swaps across 438 pools, many featuring tokens mimicking established cryptocurrencies like XRP and Litecoin.