UPDATE: Investigators link North Korea to $6.3B Binance security exploit
CIE News ·
Update to Binance investigates $6.3B exploit as issuers freeze $3B in assets
Based on reporting by Cointelegraph; not yet independently confirmed.
Blockchain intelligence firm TRM Labs attributed the $6.3 billion Binance hack to North Korea, while ZachXBT found stolen funds converging with those from the Bitget exploit.
Blockchain intelligence firm TRM Labs has linked the $6.3 billion exploit targeting Binance to North Korea with high confidence, according to Cointelegraph. The attribution follows an earlier report that Binance suspended all crypto deposits and withdrawals after hot wallets were drained between October 29 and October 30, 2026. On-chain investigator ZachXBT also identified that stolen assets from both the Binance hack and a separate exploit of Bitget are being routed to the same destination wallet address.
Cointelegraph reported that investigators, including Chainalysis and TRM Labs, tied the activity to North Korea's TraderTraitor group based on connections to earlier crypto thefts. The original intrusion reportedly occurred after an attacker compromised a DevOps engineer's laptop, gaining access to internal containers to execute transactions from Binance hot wallets 14, 16, and 34.
Stablecoin issuers have frozen approximately $3 billion in affected assets, including USDT, USDC, and FDUSD. Binance co-founder Yi He previously stated that the exchange will cover all remaining losses using internal capital and the Secure Asset Fund for Users.
Key facts
- Attributed to North Korea
- $6.3B exploit size
- Converged with Bitget funds
- $3B frozen by issuers
Read the original at Cointelegraph