North Korea behind Binance's $6B hack: Report
What's the story
North Korean hackers have been identified as the culprits behind the massive $6.3 billion theft from cryptocurrency exchange Binance, according to a report by US blockchain analysis firm TRM Labs. The attack was carried out by TraderTraitor, North Korea's elite hacking unit, using sophisticated techniques across 10 different blockchains. This incident marks the largest crypto theft in history, surpassing even the $1.5 billion stolen in the Bybit hack back in February 2025.
Investigation details
How hackers accessed Binance's system
Binance's preliminary investigation into the security breach suggests that a "compromised DevOps engineer's laptop" may have been involved.
The breach allowed an attacker to access a service container and initiate unauthorized withdrawal transactions.
However, Binance has clarified that there is no evidence of any wallet private key leak.
The company has frozen $3 billion so far and promised to "cover all losses" from its SAFU fund and company funds while cooperating with law enforcement agencies to identify these criminals.
Execution details
Here's how the heist unfolded
TRM Labs provided a detailed account of how the North Korean hackers stole cryptocurrency from Binance.
They used an EIP-7702 delegation on Ethereum to turn a Binance hot wallet into a controlled sweeper, with 50 pre-signed authorizations prepared in advance.
During this process, Binance wallets on nine other chains transferred funds to the attacker through regular signed transfers, indicating a compromise in Binance's hot wallet signing infrastructure.
Previous incidents
Previous attacks linked to North Korea
TRM Labs noted that several features of this attack are similar to previous North Korea-linked heists. The same group was also implicated in the Bybit hack.
The firm also observed similarities with the April 2026 KelpDAO hack, including small Tornado Cash withdrawals funding an operator wallet and signatures obtained in advance, then executed in one burst.
Group suspicion
Possible involvement of Lazarus Group
Security researchers have also suggested that North Korea's Lazarus Group, a state-sanctioned hacking squad known for stealing money via cyber attacks to fund the rogue state's illicit weapons program, could be behind the Binance hack.
Blockchain investigator ZachXBT and TRM Labs both pointed toward this possibility.