Clues Point to Familiar Culprit in Massive Binance Crypto Heist: North Korea

A facts-only brief, written by a local AI model from this article in The Wall Street Journal, October 30, 2026. It may contain mistakes, and it is not the article: the full story is at wsj.com.

Cybersecurity researchers and investigators attribute a $6.3 billion cryptocurrency theft from Binance to a North Korean hacking unit designated as TraderTraitor. According to analytics firm TRM Labs, the hackers moved the funds out of Binance wallets within approximately 20 minutes on Thursday evening. While stablecoin providers and other entities froze about $2.8 billion of the stolen assets, analytics firms indicate that over $3 billion is likely unrecoverable because it cannot be frozen. Tom Robinson, founder of Elliptic, described the incident as state-sponsored theft that funds North Korea’s weapons programs, noting the attack aligns with TraderTraitor’s known methods.

Background

• The Federal Bureau of Investigation identifies TraderTraitor as a state-sponsored unit originating between 2016 and 2017 under Pyongyang’s spy agency, which uses social engineering to steal cryptocurrency.
• The Multilateral Sanctions Monitoring Team reported that the group stole approximately $2.6 billion in crypto between January 2024 and September 2025, a figure that rises to over $5 billion with the Binance hack.
• U.S. officials state that cybercrime funds roughly half of North Korea’s missile program, which has recently tested intercontinental ballistic missiles capable of reaching the U.S. mainland.
• Binance stated the breach may have involved a compromised DevOps engineer’s laptop that allowed unauthorized withdrawal transactions, alongside additional points of breach.

Read the full article at wsj.com

More from Friday, October 30: