A North Korean-linked hacking organization is strongly suspected of orchestrating a massive Binance hack that drained approximately $6 billion in digital assets from the world’s largest cryptocurrency exchange.
Blockchain analysis firms revealed striking similarities between the transfer routes of the stolen funds and previous cyberattacks tied to North Korea. Experts estimate that roughly 89% of all global cryptocurrency theft damages this year are linked to North Korean state-sponsored threat actors.
According to Reuters, Chainalysis confirmed that a portion of the cryptocurrency stolen from Binance was funneled into wallets mixed with funds from the September Bitget exploit, an incident also attributed to North Korean hackers. Another analysis firm, TRM Laboratories, pointed to the notorious North Korean hacking group ‘TraderTraitor’ as the primary suspect behind the latest assault.
This same group was previously implicated in the massive $1.5 billion Bybit hacking incident in February of last year. Chainalysis data indicates that the average damage per North Korean-linked hacking attack has surged from $50.65 million in 2021 to $185.65 million this year.
Between 2021 and October 29 of this year, total global cryptocurrency hacking losses reached $22.34 billion, with North Korea-associated losses accounting for approximately 59% at $13.24 billion. The recent Binance breach occurred on October 29, resulting in the outflow of about $6.36 billion (approx. 8.4 trillion KRW), making it the largest asset theft in cryptocurrency history. Attackers successfully drained funds from 10 blockchain wallets in just 20 minutes.
Following the heist, hackers immediately attempted to evade law enforcement tracing and asset freezes. They rapidly converted easily freezeable stablecoins into Bitcoin and Ethereum, dispersing funds across thousands of distinct wallets using automated shuffling programs to maximize obfuscation.
Although the cryptocurrency industry has mobilized to block illicit transactions, TRM Laboratories estimates that the hackers still retain roughly $2.4 billion in unrecovered digital assets. Meanwhile, official confirmation from law enforcement regarding North Korea’s direct involvement is still pending, with U.S. President Donald Trump remarking that authorities are currently investigating the matter.
