The attack, which took place late on Thursday (29 October), has been described by analysts as potentially the largest theft in history. Tom Robinson, chief scientist at cryptocurrency consultancy Elliptic, told The Guardian that it was possibly the biggest theft of any kind ever recorded. The scale of the incident far exceeds last year’s theft of approximately $1.5 billion in cryptocurrency.
Binance has said it will take full responsibility for customers’ financial losses. The company is attempting to identify and recover approximately $3 billion of the stolen assets, which investigators have managed to trace.
Richard Teng, Binance’s co-chief executive, said customers’ funds remained safe and that the company would fully compensate those affected. Binance has reportedly allocated $6.34 billion to cover the losses.
Compromised engineer’s laptop may have opened the door
Initial investigations suggest that the attack may have originated from the hacking of a laptop belonging to one of Binance’s engineers. By gaining access to the device, the attackers may have found a way into an internal system, enabling them to transfer cryptocurrency without proper authorisation.
Binance later indicated that the operation was considerably more sophisticated than initially believed. According to the company, the attackers exploited several security weaknesses rather than relying on a single point of entry.
Such incidents highlight the vulnerabilities associated with cryptocurrency exchanges, where vast quantities of digital assets are managed through interconnected systems, private security keys and internal authorisation procedures. A compromised employee account or device can potentially expose an organisation’s wider infrastructure to serious financial risks.
TraderTraitor suspected of orchestrating the attack
Three cryptocurrency analysis and blockchain intelligence firms — TRM Labs, Elliptic and Chainalysis — have attributed the Binance attack to North Korea’s TraderTraitor hacking group.
TRM Labs said it had a high degree of confidence in its assessment. Cybersecurity specialists who spoke to Reuters also said that the methods used in the attack were consistent with techniques previously associated with North Korean hackers.
According to experts, TraderTraitor is among North Korea’s most capable cybercrime groups. Its operations primarily target financial institutions, cryptocurrency exchanges and organisations involved in managing digital assets.
The group is believed to include experienced operators associated with North Korea’s state cyber programme. Individuals previously linked to APT38, a North Korean hacking unit known for targeting the financial sector, have also been associated with similar activities.
Rafe Pilling, senior director of threat research at cybersecurity firm Sophos, said the initial findings surrounding the Binance incident were consistent with familiar North Korean hacking techniques.
He explained that the group was particularly skilled at understanding how organisations operate, including how employees interact with technical systems and how financial transfers are authorised. Such knowledge can allow attackers to identify weaknesses that may not be immediately apparent to security teams.
Fake job offers used to target technology workers
Cybersecurity researchers say North Korean hackers frequently target software developers, IT specialists and employees working in the financial technology sector.
Their methods extend beyond exploiting technical vulnerabilities. In some cases, they use fraudulent job offers and recruitment processes to gain access to victims’ devices and confidential information.
Attackers may approach potential employees with seemingly legitimate employment opportunities and invite them to participate in online interviews. Candidates are then persuaded to download software or files that contain malicious programmes.
Once installed, the malware can provide attackers with access to login credentials, sensitive information and, in some cases, control over the victim’s computer. If the targeted individual works for a financial institution or technology company, the compromised device may become an entry point into the organisation’s internal systems.
Researchers say these operations are often carefully planned. Hackers seek to understand an organisation’s security arrangements, employee responsibilities and financial approval procedures before attempting to move digital assets.
Similar techniques have also been used against decentralised finance organisations, where vulnerabilities in digital infrastructure and internal processes can expose substantial amounts of cryptocurrency to theft.
North Korea’s growing record of cryptocurrency theft
The alleged involvement of North Korean hackers in the Binance incident comes amid a series of major cryptocurrency thefts attributed to the country over recent years.
According to a Chainalysis estimate cited in a Reuters report, North Korea had stolen at least $6.75 billion in cryptocurrency by the end of 2025. This figure includes approximately $1.5 billion stolen from the Bybit cryptocurrency exchange in February 2025.
Another major incident occurred in September, when Bitget, a separate cryptocurrency exchange, was reportedly targeted in an attack involving the theft of $387 million in digital assets.
Taking these incidents into account, Michael Bernhardt, a researcher at cybersecurity firm DTEX, estimated that the total value of cryptocurrency stolen by North Korea had reached approximately $13.5 billion.
The scale of these alleged operations has raised concerns among governments and financial security experts, particularly because cryptocurrency transactions can cross international borders quickly and involve multiple digital platforms.
Although blockchain transactions are recorded publicly, tracing stolen assets does not necessarily mean they can be recovered. Criminal networks can move funds through multiple transactions and services in an effort to obscure their origins.
Experts claim that North Korean hackers receive assistance from organised criminal networks in China to launder stolen cryptocurrency. These networks allegedly help conceal the source of the funds and make them available for further use through different financial channels.
US warns of North Korean operatives working abroad
Washington has repeatedly accused North Korea of using cybercrime to generate revenue and circumvent international sanctions.
In a warning issued on 13 October, the US Federal Bureau of Investigation (FBI) said North Korean nationals were secretly obtaining employment at technology and financial companies in several countries, including the United States.
According to the FBI, individuals involved in these schemes not only send their earnings back to North Korea but may also steal sensitive information from the organisations employing them.
US officials have alleged that money generated through these overseas employment operations, together with proceeds from cryptocurrency theft, helps finance North Korea’s nuclear and military programmes.
A spokesperson for the US Department of State described North Korea’s cyber activities as a growing international threat. The spokesperson said the country was becoming increasingly reliant on cybercrime to evade international sanctions and generate revenue for its weapons of mass destruction and ballistic missile programmes.
Cryptocurrency theft and money laundering have consequently become important elements of the alleged financial operations.
Cybercrime and North Korea’s military ambitions
Bernhardt has also drawn attention to the relationship between North Korea’s cyber operations and its broader military ambitions.
According to him, North Korean leader Kim Jong Un has called for the country to achieve dominance in various military technologies, including drones. Bernhardt believes that progress in North Korea’s drone programme is directly connected to the financial resources generated through cryptocurrency theft and income earned by North Korean nationals working in overseas technology sectors.
North Korea has also been providing military assistance to Russia amid its war effort, including personnel, ammunition and weapons components. Bernhardt said the financial networks supporting these activities were linked to the same broader system of revenue generation.
The allegations have raised concerns that cryptocurrency theft may serve purposes extending well beyond financial gain. If the stolen assets are channelled into state activities, cyberattacks against private financial platforms could have implications for international security.
The Binance incident therefore represents more than a major security challenge for a cryptocurrency exchange. It has renewed attention on the alleged use of cybercrime by state-backed actors to generate funds, evade international restrictions and support military programmes.
For cryptocurrency platforms, the incident also reinforces the need for stronger internal security, tighter control over employee access, better protection of sensitive devices and more effective monitoring of suspicious transactions. As digital assets become increasingly important in global finance, the ability to protect them from sophisticated cyberattacks is emerging as a major challenge for both private companies and governments.
