Finance · Cybersecurity · North Korea

North Korea-Linked Unit Blamed for $6.3 Billion Binance Hack, but Attribution Is Not Official

Three blockchain-intelligence firms say evidence points to TraderTraitor, a North Korea-linked hacking unit. Their assessments materially advance the investigation, but Binance and government authorities have not confirmed who carried out the theft.

By Health Politics Daily News Desk · October 31, 2026 at 1:59 a.m. ET

Verified baseline

Binance says attackers stole approximately $6.3 billion in token assets from its hot wallets beginning at 8:05 p.m. UTC on October 29. The exchange says roughly $3 billion has been frozen on-chain and that it will absorb the losses rather than charge customers. It has not attributed the breach to any person or government.

TRM Labs says with high confidence that TraderTraitor, a North Korea-linked unit, conducted the theft. Elliptic says North Korea-linked actors were likely responsible, while explicitly describing caveats. Associated Press and Reuters report that Chainalysis reached a similar assessment.

No government or law-enforcement agency had publicly confirmed responsibility when this article was completed. North Korea routinely denies involvement in cryptocurrency thefts.

What the firms say links the attack to TraderTraitor

TRM and Elliptic point to preparation patterns seen in earlier North Korea-linked attacks: small withdrawals from the Tornado Cash mixer, advance testing, a coordinated burst of valid transactions and apparent compromise of the systems or people around wallet signing rather than the underlying cryptography.

Elliptic also traced a small portion of the stolen funds—about $39,000—to an address that received proceeds linked to the September Bitget theft. That establishes shared laundering infrastructure, not necessarily the same attacker. A professional laundering service can handle funds for multiple clients.

The attack drained hot wallets across at least 10 blockchains. Binance initially said a compromised engineer's laptop may have enabled access to a service container; its second update said investigators found additional points of breach. The company says it has found no evidence that private keys leaked and has not yet published its promised technical post-mortem.

Why confidence is not certainty

Elliptic notes that the thief moved more slowly than North Korea-linked operators often do, leaving billions of dollars in stablecoins available for issuers to freeze. The use of market makers and decentralized lending also differs from some previous bridge-heavy laundering patterns. The shared-address link is small relative to the total theft.

TRM says its judgment also relies on non-public off-chain intelligence. That may strengthen its internal assessment, but readers cannot independently test evidence the firm has not disclosed. Independent agreement among specialized firms is consequential; it still does not equal a court finding or government attribution.

The national-security context

The FBI officially attributed the $1.5 billion Bybit theft in February 2025 to TraderTraitor and asked exchanges, bridges and other services to block linked transactions. U.S. officials have long said North Korea uses cryptocurrency theft and overseas IT-worker revenue to evade sanctions and support weapons programs.

That history makes the Binance assessment plausible, but precedent is not proof of this attack. The most probative missing evidence is how the attacker first entered Binance's systems and whether forensic indicators match infrastructure controlled by a known state-linked operator.

Practical implications

• For Binance customers: attribution does not change the immediate advice. Use official Binance channels, expect phishing attempts and never share passwords, seed phrases or remote access with purported recovery agents.
• For crypto firms: the incident highlights risk around developers, signing infrastructure and time-limited access—not only wallet keys. Staff-targeted social engineering deserves the same scrutiny as smart-contract code.
• For policymakers: freezing approximately half the stolen value shows both the utility and the governance power of stablecoin issuers. The remaining assets may be moved through bridges, mixers and over-the-counter brokers.
• For investors: an attribution assessment is not a reliable trading signal. This article does not provide personalized financial advice.

Fact, analysis, forecast and opinion

Verified fact: Binance reported a $6.3 billion theft; TRM, Elliptic and Chainalysis independently linked it to North Korea's TraderTraitor unit. Analysis: overlapping laundering infrastructure and familiar tradecraft support the assessment, but public evidence does not eliminate alternative explanations. Forecast: law enforcement may issue a formal attribution after reviewing Binance's systems and fund movements, but no timetable is known. Opinion: Health Politics Daily takes no position on cryptocurrency investment or sanctions policy and treats the private-firm findings as strong leads, not final proof.

For the incident baseline, read our initial report on the Binance breach. Our coverage of the FEC filing-system outage explains a separate cyber incident affecting a public financial system.

What remains uncertain

The initial compromise path, every point of breach, the identity and location of the operators, the role of any laundering network, the final recoverable amount and whether authorities will formally attribute the attack are unresolved. Binance's promised technical post-mortem and updated proof of reserves remain pending.

Principal sources

• Binance — security incident update #2
• TRM Labs — attribution and transaction analysis
• Elliptic — attribution evidence and caveats
• FBI — 2025 TraderTraitor attribution for the Bybit theft
• Reuters — independent reporting on the new attribution

No suitable directly relevant authorized video with clear persistent embedding permission was available.