North Korea gets away with $3 billion from Binance

A notorious North Korean cybercrime group has stolen around $6.3 billion in cryptoassets from multiple hot wallets^a belonging to Binance, the world’s largest cryptocurrency exchange, and still controls around $3 billion of it after stablecoin issuers and other protocols froze what they could. These estimates are still in flux as various platforms work to freeze tokens or otherwise thwart the attacker from cashing out, and as both Binance and independent security researchers continue their investigations.

Unlike many supposedly “multi-billion dollar” crypto hacks, where the headline figure relies on the notional value of illiquid assets that could never be sold for anywhere near that amount, the majority of these stolen assets were major stablecoins, bitcoin, ethereum, and other fairly liquid tokens.

Binance has estimated the total theft at $6.3 billion. At least $5.5 billion of these were liquid assets. Tether announced they had frozen at least $1.567 billion of the stolen USDT, and Circle has frozen around $800 million of stolen USDC. World Liberty Financial froze the $27 million in USD1 stolen by the attacker, and the Arbitrum ethereum layer-2 network froze an additional $30.5 million that had moved to its network. The attacker is estimated to have made off with between $2.4 billion and $3.3 billion.

Binance founder Changpeng Zhao, who is legally not allowed to have any active role with the company [I98] yet still has remarkable amounts of inside knowledge into its inner workings, posted on Twitter less than an hour after the theft that “User funds are safe!”, adding early estimates of how much Tether and Circle had frozen. He added, “I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”

He later tweeted “Loss might be a bit higher than [$1 billion], but will cover.” (Why a person who is barred from any control over Binance would be the one promising this is an exercise I will leave to the reader.)

Binance keeps an emergency insurance fund in case of exploits or other crypto disasters. Its most recent balance report puts it at around $1.3 billion.¹ Unless more is recovered, Binance will either fail to make users whole or dip into its own balance sheet — potentially to the tune of 10 figures.

Binance later wrote that their "initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop", which allowed an attacker to “submit unauthorized withdrawal transactions.” They estimated the total theft at around $6.3 billion, with approximately $3 billion frozen.² While the assets frozen by Tether and Circle will likely easily be returned to Binance, other non-centralized assets frozen by various protocols may be inaccessible both to the attacker and to Binance.

Blockchain security firm TRM Labs has attributed the theft to TraderTraitor, a North Korean state-sponsored cybercrime group also known as the Lazarus Group.³ The group has been linked to other massive cryptocurrency heists, including a massive $1.5 billion theft from the Bybit cryptocurrency exchange in 2025 [W3IGG]. This Binance hack has now surpassed the Bybit hack for the largest cryptocurrency theft.

The contagion also threatens to spread beyond Binance. Aave, a defi lending project, paused some of its markets to stop the attacker from depositing stolen assets as collateral and borrowing against them — a move that could otherwise leave it holding significant bad debt. Protocols that are slower to respond may not be so lucky.

The Binance theft came within hours of a separate, much smaller theft of around $2.7 million from Polymarket users [W3IGG], and some people wondered whether the two were connected. I doubt it. Polymarket has blamed its incident on a compromised third-party vendor, which an attacker apparently used to inject a malicious script into the site’s frontend and steal user funds. The Binance attacker got access to the exchange’s own hot wallets. They’re very different attacks, and nothing besides timing ties them together so far.

October 29 at 8:47pm: Updated to remove some skepticism around whether bitcoin attributed to the attacker was stolen, after a conversation with another researcher made me less confident the wallets were unrelated.

October 30 at 1:17am: Updated with a statement from Binance and the report from TRM Labs.