Brief
North Korean hackers blamed for $6.3 billion Binance theft
Cybersecurity firms say the attackers posed as developers and investors to gain access before stealing billions from the exchange.
By Felo News Desk · Published
Cybersecurity experts say North Korea’s state‑backed hacking units are the primary suspects behind the $6.3 billion theft from Binance, the largest cryptocurrency robbery in history, according to a New York Post report published on Oct. 30, 2026.
What happened
The hack, described as a 20‑minute cross‑chain attack, resulted in the loss of roughly $6.3 billion from Binance’s wallets. The exchange subsequently froze about $3 billion of the stolen assets and pledged to cover all user losses.
What the reports add
Lisa Zhao, security‑operations lead at the cybersecurity firm SlowMist, told the Post that the attackers used confidence‑trick tactics, posing as project teams or investors offering paid work to developers. She said the hackers modified publicly available software projects, inserting malicious code that appeared innocuous during debugging or testing. Zhao added that her team traced links between the stolen Binance funds and IP addresses tied to earlier North Korean thefts, including the Phemex theft in early 2025.
Blockchain‑intelligence firm TRM Labs also attributed the attack to North Korea’s state‑backed “TraderTraitor” operation, citing high confidence and similarities to prior heists.
What was said
"They attack people, not code," Zhao said, emphasizing the social‑engineering focus of the operation. "In many of the cases we encountered, no individual step looked like an attack — just helping with debugging, testing some code or changing a setting," she added.
She further noted, "We detected links between the Binance hackers’ funds and addresses involved in the Phemex theft in early 2025, which we already linked to North Korean hackers."
How it came about
SlowMist’s 2025 investigations revealed a pattern where attackers first gain trust by offering developers paid projects or investment opportunities. Once the malicious code is run, even in isolated environments, the hackers request adjustments that weaken security controls, allowing deeper network penetration and credential theft. Using the compromised company’s own tools, they then move funds to wallets associated with known North Korean IP addresses.
Key facts
- North Korean state‑backed hackers are identified as the main suspects in the $6.3 billion Binance hack. (nypost.com)
- The attackers used social‑engineering tactics, posing as developers or investors offering paid work. (nypost.com)
- TRM Labs attributes the attack to North Korea’s TraderTraitor hacking unit with high confidence. (nypost.com)
- Binance froze about $3 billion of the stolen assets and pledged to cover all user losses. (nypost.com)
- Lisa Zhao of SlowMist said the hackers modify publicly available software and insert malicious code that appears harmless. (nypost.com)
Sources
- [1] nypost.com — originally reported as “How North Korea’s ruthless state sponsored hackers, main suspects in the $6.3B Binance heist, operate”
