An assortment of United States law enforcement agencies and major blockchain analysis and cybersecurity firms are attributing the massive $6.3 billion Binance crypto hack to state-sponsored North Korean hackers, though Binance itself has yet to make a formal statement on attribution and President Trump threw some uncertainty into the situation with a noncommittal statement of his own to the media over the weekend.
The North Korean hackers are certainly the group most associated with eye-popping crypto hacks, having stolen about $6.5 billion in total from assorted exchanges and platforms since 2017 prior to this incident. If the Binance caper is indeed their work, the stolen funds would nearly double their running total by itself. However, Binance says that it was able to successfully freeze about $3 billion of the total before it was exfiltrated.
Record-setting crypto hack prompts asset exodus
The breach will still likely stand as the largest crypto hack in history when the dust settles, shooting well past the $1.5 billion taken from Bybit in early 2025. The incident has now been formally linked to North Korean hackers by the FBI, US Secret Service and the criminal investigations unit of the US Secret Service among other government agencies. Independent blockchain and analysis firms that have come to the same conclusion include Chainalysis, Elliptic, Pangolin Intelligence and TRM Labs.
The Binance crypto hack took place on October 29 and was first reported to the public on October 30. While the company itself has yet to attribute it to the North Korean hackers, it has published some information on its internal investigation. At the moment the breach is linked to a compromised laptop belonging to an engineer, but the company says that it was not the result of abusing “one engineer’s permissions” and that the full attack path is still unknown but was multi-step and complex. The attackers were ultimately able to make withdrawals from a Binance-owned “hot wallet” in a variety of asset types, however, making off with a mix of BNB, BTC, ETH, USDT, and USDC.
Dr. Darren Williams, Founder and CEO of BlackFog, expands on the seriousness of this being the suspected entry point: “The most concerning aspect of the Binance incident extends beyond the reported $6.3 billion loss. It is the potential that a compromised engineer’s laptop served as an entry point to systems authorized to approve withdrawals. Binance maintains that the breach involved greater complexity than a single device compromise and continues its investigation. However, safeguarding private keys is insufficient if adversaries can manipulate the infrastructure entrusted with transaction authorization.”
“This is the same security gap we are creating with Shadow AI and agentic AI,” Williams adds. “People and automated agents are being given access to sensitive information, infrastructure and financial workflows without enough control over what they can do with it. Companies need to restrict access, independently verify high-risk actions and stop suspicious outbound movements before money or data leaves. Once it is gone, recovery becomes a race against time.”
John Bruggeman, vCISO of CBTS, adds: “Binance has said that this was not one person’s permissions being abused, which is a good start. From a cyber perspective no single person should have that much authority. But I’d argue that detail makes the real question more interesting, not less: if it took a multi-step attack chain across multiple points of breach to pull this off, and the end result was still losing over $6 billion in crypto, the attack chain, the withdraw process, never hit a control that required an independent human or system outside the compromised path to approve it. Ooops. That’s the cybersecurity gap. A gap I would have expected to be found in an audit.”
Binance says that individual user wallet credentials were not compromised, but the hackers were able to abuse a protocol that allowed them to fund and then drain the internal company wallet in only about 20 minutes. The hackers were likely inside Binance’s systems at least 36 hours prior to the transfers initiating, however, needing time to prepare bogus signatures to authorize transactions.
In addition to nearly half of the stolen funds being frozen, the company has said that it will replace 100% of all lost assets from a combination of its Secure Asset Fund for Users (SAFU), portions of its Futures Insurance Fund, and corporate treasury reserves. As of this writing it says it has backed or restored about 95% of funds already and is working on restoring the remainder. The incident forced an extended pause on withdrawals, however, with the first phase of restoration beginning on November 1. After that initial wave of account restoration, the exchange reports an outflow of about $4.72 billion in withdrawals, a number in the ballpark of what was seen after Silicon Valley Bank collapsed in 2024 and FTX went under in 2022. However, it also took in a little over $1 billion in new deposits during the period and has declared that 98% of its user base has opted to stay in the wake of the crypto hack.
FBI names state-sponsored “TraderTraitor” group of North Korean hackers
The FBI and several of the blockchain analytics firms have specifically named members of the “TraderTraitor” group (also tracked as APT38) as the culprits behind the crypto hack. This is a group of North Korean hackers associated with the state-backed Lazarus outfit that has been a general global menace for over 10 years, responsible for numerous prior major breaches such as the 2014 raid on Sony Pictures, the WannaCry ransom outbreak and multiple attacks on both land-based banks and crypto exchanges as well as pharmaceutical companies during the Covid-19 outbreak. It is essentially considered North Korea’s leading government-directed hacking group, tasked primarily with obtaining funding for the heavily sanctioned regime.
The $3 billion that was frozen from the crypto hack was primarily in various forms of stablecoin. The other types of assets will be much more difficult to recover, and the North Korean hackers have already been spotted converting much of it into Ethereum likely to be moved on to mixing and swapping services that will put it much farther out of reach.
North Korean hackers are generally on the forefront of these types of scams, sometimes deploying complex social engineering approaches. The Ronin Bridge breach of 2022 involved tricking a developer into believing they were applying for a legitimate job, to include a real-time video interview. And in April of this year, the hackers compromised the Drift exchange after meeting in-person with platform contributors at multiple cryptocurrency conferences over a period of about six months.
Rand Davis, Chief Technology Officer at SecurityScorecard, notes that the North Korean hackers have since made the “fake job interview” ploy a staple of their playbooks: “Our STRIKE Team detected a North Korean actor targeting one of our DevOps engineers through a fake job offer on LinkedIn tied to a Web3 project. The ‘skills test”‘carried a backdoor. Our Information Security team blocked the attack before it caused damage. STRIKE shares its findings with the FBI and the security community, and linked the activity to a broader campaign against developers.”
And Javvad Malik, Lead CISO Advisor at KnowBe4, sums up what organizations can learn from the Binance crypto hack: “The Binance incident yet again shows the most catastrophic breaches rarely exploit exotic zero-days in core protocols but instead hinge on privileged access failures. In plain terms, the breach reportedly began when attackers compromised an engineer’s laptop, which served as a stepping stone into internal infrastructure. For company leaders, the lesson is straightforward: trusting your outer perimeter is no longer enough, and no single worker or machine should ever hold the keys to the entire kingdom. Leaders need to build walls between everyday work laptops and core financial systems, require multiple independent people to sign off before large amounts of money can leave the building, and set automatic spending caps that immediately freeze suspicious, high-volume transactions before the damage is done.”
