Analysts link North Korea to Binance’s US$6.3bn Oct 29 hack
Binance has located about US$3bn in stolen assets, while US authorities link North Korean cyber operations to nuclear and military funding.
- Blockchain analysis firms TRM Labs and Chainalysis have attributed the US$6.3 billion Binance hack to the North Korean hacking group known as TraderTraitor.
- U.S. authorities and security experts state that North Korea uses the proceeds from such large-scale cryptocurrency thefts to finance its weapons of mass destruction and ballistic missile programs.
- The TraderTraitor group, described as highly capable, often uses methods like fake job recruitment offers to spread malware and infiltrate cryptocurrency companies.
- Multiple experts, including a Sophos threat specialist, noted that the methods used in the Binance breach were consistent with those previously employed by North Korean hackers.
Blockchain analysis firm TRM Labs has attributed the record US$6.3 billion theft from cryptocurrency exchange Binance on October 29, 2026, to North Korea’s TraderTraitor group. US authorities warn that North Korean cybercrime helps finance the country’s weapons programmes.
Chainalysis also attributed the Binance theft to TraderTraitor. Cybersecurity experts described North Korean hackers as among the world’s most prolific crypto thieves.
Binance reported that about US$3 billion had been located following the exchange’s security breach, as it worked with partners to freeze stolen cryptocurrency.
Researcher puts North Korean crypto thefts at US$13.5bn
DTEX cybersecurity researcher Michael Barnhart put North Korea’s minimum cumulative crypto thefts at roughly US$13.5 billion.
Chainalysis’s December 2025 assessment put cumulative theft attributed to North Korea at at least US$6.75 billion, including the US$1.5 billion stolen from Bybit in February 2025.
Chainalysis also linked North Korean attackers to the US$387 million stolen from Bitget in September 2026.
Barnhart called TraderTraitor North Korea’s most capable financially focused hacking group, with veteran APT38 financial hackers. After Bitget, many researchers expected another major theft, he added.
TraderTraitor uses fake recruitment to target developers
North Korean hackers target cryptocurrency developers and information technology staff with fake recruitment offers designed to spread malware, a 2022 joint US advisory warned. The warning, which used the TraderTraitor name, came from the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency and Treasury Department.
Chainalysis describes fake hiring processes designed to obtain login credentials and other sensitive information. FBI guidance warns that bogus recruitment exercises can persuade candidates to run malicious software, giving attackers access to company systems.
Sophos threat intelligence specialist Rafe Pilling judged early Binance breach reports consistent with North Korean methods and highlighted TraderTraitor’s expertise in transfer approvals.
US officials link cybercrime to weapons programmes
The FBI warned in an October 13 advisory that North Koreans secretly work for technology and financial companies in the United States and elsewhere, earning government revenue and stealing sensitive data. The agency linked these operations to nuclear and other military funding.
A US State Department spokesman called North Korean cybercrime a “global problem”, describing cryptocurrency theft and laundering as significant ways to evade sanctions and fund weapons of mass destruction and ballistic missiles.
Barnhart said Chinese organised-crime groups launder cryptocurrency stolen by North Korea.
North Korean leader Kim Jong Un wants “absolute superiority” in drones and other military technology. Barnhart linked drone advances to crypto theft and overseas technology work.
Barnhart also linked North Korea’s cybercrime revenues to troops, munitions and weapons components sent to support Russia’s war effort, calling crypto theft “a national security issue”.
