TLDR
- Researchers say North Korea’s TraderTraitor group, a Lazarus subunit, likely stole over $6 billion from Binance.
- TRM Labs, Chainalysis and ZachXBT all point to the same group.
- ZachXBT says stolen Binance and Bitget funds ended up at the same address.
- One source cautions the hack has not been definitively tied to Lazarus.
- Binance traced the attack to a compromised DevOps engineer’s laptop.
Several blockchain research firms say North Korean hackers likely stole more than $6 billion in crypto from Binance, the world’s largest crypto exchange. The theft happened on Thursday.
JUST IN: 🇰🇵 North Korea responsible for $6 billion Binance hack, CNN reports. pic.twitter.com/nRHzV6xHV1
— Watcher.Guru (@WatcherGuru) October 30, 2026
Binance estimated the impact at $6.3 billion. Chainalysis said the group stole $6.4 billion, slightly above that estimate.
Who Researchers Point To
TRM Labs said the group TraderTraitor was likely behind the attack. It said it had “high confidence” in that finding, based on onchain and offchain intelligence.
TraderTraitor is a subunit of North Korea’s Lazarus Group. Lazarus is a state-sanctioned hacking squad known for stealing money to fund the country’s weapons program.
Chainalysis CEO Jonathan Levin said the hack was likely done by TraderTraitor because of links to a previous hack. Blockchain investigator ZachXBT also called the attacker “likely Lazarus.”
It’s likely Lazarus Group
— ZachXBT (@zachxbt) October 30, 2026
ZachXBT said stolen funds from Binance and the earlier Bitget hack ended up at the same address after moving through THORChain. He said this indicates the same actor is likely behind both incidents.
He added that the Bitget attack had already been attributed to TraderTraitor. Blockaid CEO Ido Ben-Natan said the tactics and sophistication matched past North Korean operations.
Ben-Natan said North Korea-linked actors were tied to several major hacks this year. He named the Kelp DAO, Bitget and Drift incidents.
One person familiar with crypto investigations told CoinDesk that very few actors could pull off such a hack. The person cautioned that it had not been definitively attributed to Lazarus.
The person also said North Korean groups are usually faster at moving and selling stolen funds than the Binance hackers were on Thursday.
History of Large Crypto Thefts
North Korea has been linked to most, if not all, of crypto’s biggest hacks. Lazarus is perhaps the best-known threat actor in the space.
The group is tied to the $1.46 billion hack of Dubai-based exchange Bybit in February 2025. At the time, it was the largest attack of its kind, and it made up most of the $2.02 billion stolen in crypto that year.
Lazarus is also believed to be behind the $292 million KelpDAO exploit in April. It is also linked to the $625 million Ronin Network hack in 2022.
US authorities have linked TraderTraitor to some of crypto’s largest thefts. The FBI also joined US and Japanese investigators in blaming North Korean actors for the theft of more than $300 million from DMM Bitcoin in May 2024.
The FBI says TraderTraitor targets company employees through social engineering. In the DMM case, an attacker posing as a recruiter sent a malicious coding test to an employee of wallet provider Ginco.
Investigators said the access was likely used to manipulate a legitimate transaction request. That diverted funds to attacker-controlled wallets.
Binance said in a late Thursday update that it had traced the attack vector to a compromised DevOps engineer’s laptop.
