30.10.2026 09:01
Suspicion of North Korea has emerged in an approximately $6.3 billion cyberattack targeting the cryptocurrency exchange Binance. While blockchain analysis companies state that North Korea-linked hackers may be behind the attack, it was claimed that the hackers infiltrated the system through an employee's laptop. Approximately $3 billion in assets were frozen, while it was reported that billions of dollars in cryptocurrency controlled by the attackers are being tracked.
New details have emerged in the investigation into the cyberattack targeting Binance, one of the world's largest cryptocurrency exchanges.
Blockchain analysis firm TRM Labs announced that it assesses with a high level of confidence that the attack was carried out by the North Korea-linked hacker group TraderTraitor.
The group, associated with North Korea's state-sponsored cyber operations, is said to have previously been linked to major cryptocurrency thefts.
However, the identity of the attackers has not yet been definitively established by the official investigation.
THEY MAY HAVE INFILTRATED THE SYSTEM THROUGH AN EMPLOYEE'S COMPUTER
According to Binance's initial review, the attackers may have taken over the laptop belonging to one of the company's DevOps engineers.
It is assessed that through this route, access was gained to a service environment in the company's systems and unauthorized withdrawals were carried out.
The company stated that no evidence was found indicating that private keys belonging to cryptocurrency wallets had been leaked. The technical cause of the attack is expected to become clear after the investigation is completed.
$6.3 BILLION ASSET MOVEMENT
According to TRM Labs' analysis, on October 29, the attackers transferred approximately $6.36 billion worth of crypto assets from wallets belonging to Binance across 10 different blockchain networks.
This amount is more than four times the attack on the Bybit exchange in February 2025, which caused losses of approximately $1.5 billion.
The U.S. Federal Bureau of Investigation (FBI) had also attributed the Bybit attack to the North Korea-linked TraderTraitor group.
$3 BILLION FROZEN, BILLIONS OF DOLLARS BEING TRACKED
Binance announced that as a result of its work with partners in the blockchain sector, approximately $3 billion worth of assets had been frozen.
According to TRM Labs' examination, the attackers control approximately $2.4 billion worth of Bitcoin and Ethereum.
While transfers between suspicious wallets are being monitored, it is assessed that the attackers may try to cash out the assets they seized through different networks and cryptocurrency transactions.
NORTH KOREA'S CYBER OPERATIONS BACK UNDER THE SPOTLIGHT
U.S. and South Korean authorities had stated that cryptocurrency attacks carried out in the past by North Korea-linked hackers were used to generate revenue for the country's leadership.
For this reason, claims of a North Korean link to the latest attack are also being followed closely at the international level.
On the other hand, it has not yet been confirmed that the approximately $6.3 billion amount has reached the North Korean leadership. The fact that some of the assets associated with the attackers have been frozen also shows that the total amount seized and the amount usable are different from each other.
BINANCE: WE WILL COVER ALL LOSSES
After the incident, Binance management temporarily suspended deposit and withdrawal transactions as part of security checks.
The company announced that users' assets are safe and that losses arising from the attack will be covered by the SAFU security fund and company resources.
It was reported that work with security units continues to identify the attackers and recover the assets.