Why investigators point to North Korea over the $6.3bn Binance hack

Binance customers withdrew a net $3.64 billion after the cryptocurrency exchange began restoring withdrawals on 1 November, the company said, as investigators traced the $6.3 billion theft behind the suspension to a group they say is backed by North Korea.

Blockchain analysis firms Chainalysis and TRM Labs have identified the group as TraderTraitor. The FBI also blamed North Korea for the theft on 31 October, although it did not set out the full basis for its conclusion.

Chainalysis said its strongest evidence was an on-chain link between cryptocurrency stolen from Binance and funds from an earlier theft at exchange Bitget, which had also been attributed to North Korean actors. TRM said it made its assessment with high confidence, drawing on intelligence from transactions and other sources.

TRM said aspects of the preparation resembled previous attacks linked to North Korea, including small withdrawals from a service that obscures the origin of cryptocurrency and signatures obtained in advance. It noted, however, that the laundering pattern observed so far differed from one seen after an earlier attack.

Binance said its internet-connected “hot wallets” were compromised on 29 October. TRM estimated that $6.36 billion was taken, making it the largest cryptocurrency theft on record and roughly four times the size of the 2025 Bybit hack.

Binance initially suggested a compromised laptop may have been involved, but later said it had found additional points of breach. Its investigation into the full sequence continues.

North Korea has previously denied accusations that it uses state-linked cyber units for theft. Its mission in Geneva and embassy in China did not respond to requests for comment on this attack, Reuters reported. US President Donald Trump said on 31 October that it was not yet clear whether North Korea was involved.

Binance said on 1 November that it had covered about 95% of the affected amount by purchasing replacement assets with company resources. That is not the same as recovering 95% of the stolen cryptocurrency. On 30 October, the exchange said about $3 billion in affected assets had been frozen; frozen funds have not necessarily been returned.

The exchange said the $3.64 billion net outflow represented 2.1% of its assets. Analytics platform DefiLlama put outflows higher, at $4.36 billion, but Binance said that figure did not account for transfers to its own new hot wallet.