Markets › News › Exchanges

Binance Hack Investigation Links North Korea's TraderTraitor to $6.3B Heist

Blockchain analysts identify North Korea's TraderTraitor as the likely perpetrator of Binance's record-breaking $6.3 billion hack.

Blockchain analysts identify North Korea's TraderTraitor as the likely perpetrator of Binance's record-breaking $6.3 billion hack. This is an original TLT brief synthesising 10 outlets (Cointribune, Bitcoin.com, CryptoNews, and others), with their figures cross-checked, plus live market data, as of Fri, 30 Oct 2026 14:45:03 UTC.

Why it matters

This development highlights the growing sophistication of state-sponsored cyberattacks on crypto platforms, posing significant security and geopolitical risks to the industry.

Key takeaways
  • Binance suffered a $6.3 billion hack on October 29, the largest crypto theft on record.
  • TRM Labs and ZachXBT attribute the attack to North Korea's TraderTraitor group.
  • Stolen funds from Binance and Bitget were traced to the same address.
  • Tron network activity surged during the hack as attackers bought TRX.
What the reporting agrees on

Cointribune, Bitcoin Sistemi, and Bitcoin.com all report that blockchain analysts, including TRM Labs, have identified North Korea's TraderTraitor group as the likely perpetrator of the $6.3 billion Binance hack. However, Bitcoin Sistemi cites a higher estimated loss exceeding $2 billion, while other outlets agree on the $6.3 billion figure. The discovery of stolen funds from both Binance and Bitget at the same address, reported by Cointribune, adds further evidence to the investigation.

The story so far · 3 briefs
  1. BNB Chain Suffers $2.84M Hack Linked to North Korea's SquidSquad
  2. Binance Hack: $6.36B Heist Initiated with $296M XRP Transfer After 36-Hour Preparation
  3. Binance Hack Investigation Links North Korea's TraderTraitor to $6.3B Heist — this brief

The cryptocurrency exchange Binance suffered a massive security breach on October 29, with hackers making off with approximately $6.3 billion in digital assets. This incident is now considered the largest crypto theft in history.

Blockchain analytics firm TRM Labs, as reported by Cointribune and Bitcoin.com, has attributed the attack to the North Korean hacking group TraderTraitor, a sub-unit of the notorious Lazarus Group. This attribution is based on a high level of confidence in the evidence gathered by investigators.

Independent crypto investigator ZachXBT provided additional evidence by discovering that stolen funds from both Binance and Bitget were traced to the same address, as reported by Cointribune. This finding suggests a connection between the two attacks and strengthens the case against TraderTraitor.

During the hack, attackers engaged in significant transactions on the Tron network, as detailed by Bitcoin Sistemi. They purchased a large amount of TRX to potentially bypass network congestion measures, causing the coin's price to spike. This activity indicates the hackers' strategic manipulation of the network during the heist.

The broader market context shows a total crypto market cap of $2.67 trillion, with Bitcoin down 3.50% in the last 24 hours. The overall market sentiment, as measured by the Fear & Greed Index, remains at 30, indicating a state of 'Fear.'

The market when this published · October 30, 2026
Total market cap$2.67T
Bitcoin 24h-3.50%
Ethereum 24h-4.09%
BTC dominance58.3%
Fear & Greed30 · Fear
Cross-source data check

1 key figure independently matched across 3 outlets reporting this story.

$6.3B8× corroboratedCointribune, Bitcoin.com, CryptoNews, Cointelegraph, Crypto.news, Live Bitcoin News, CoinCodex, 99Bitcoins

TLT extracts the figures each outlet reports and flags the ones that agree. Numbers cited by only one outlet are attributed in the brief, not shown as corroborated.

Binance Hack Investigation Links North Korea's TraderTra — questions & answers

How much was stolen in the Binance hack?

The hack resulted in a loss of approximately $6.3 billion, according to multiple outlets.

Who is believed to be behind the Binance hack?

Blockchain analysts, including TRM Labs, attribute the attack to North Korea's TraderTraitor group.

What evidence links the hack to North Korea?

The discovery of stolen funds from Binance and Bitget at the same address, as reported by ZachXBT, provides key evidence.

Which outlets reported this story?

This is an original TLT brief that synthesises reporting from Cointribune, Bitcoin.com, CryptoNews, The Block, Cointelegraph, Decrypt, Crypto.news, Live Bitcoin News, CoinCodex, 99Bitcoins, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.

In this storyBinance CompanyZachXBT PersonLazarus Group Organization
TLT Newsdesk Data-stamped

TLT's newsdesk writes original briefs by synthesising coverage from across the crypto press — 50+ outlets including CoinDesk, The Block, Decrypt and Cointelegraph — cross-checking the figures they report — and verifying them against on-chain data from DeFiLlama and mempool.space — plus live market context (CoinGecko, Binance). We summarise and link to every source; we never reproduce full articles. Read our editorial standards and how we use AI. Not financial advice.

Market data verified against CoinGecko & Binance · October 30, 2026 ⛓ Timestamped at Bitcoin block #973,823 sha256:57c3d469f8030e53

Original summary — not financial advice. This is an original TLT brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.