North Korea Denies US$6.3 Billion Binance Hack

NORTH KOREA · ANALYSIS

The North Korea crypto hack at Binance, about $6.3 billion by the count of TRM Labs, would be the largest crypto theft on record, and Pyongyang denies it. For US readers it matters because the FBI, US exchanges and US sanctions law all sit at the centre of the case.

North Korea is a closed, heavily sanctioned state on the Korean Peninsula, and stolen crypto is one of the few ways it can raise hard currency. This analysis explains the accusation, who makes it, how the theft and laundering work, and what remains unproven, building on the Asia Intelligence Brief.

What Is Alleged and Who Blames North Korea

The Alleged Theft

About $6.3 billion was taken from the crypto exchange Binance on Thursday 29 October 2026, according to the Korea Herald and UPI. The Nextgov report is dated 30 October 2026.

The money moved across 10 blockchains, most of it in about 20 minutes, according to the Associated Press. The attackers reportedly compromised several systems, including a Binance engineer’s laptop, to reach a privileged system that allowed large withdrawals.

Binance said it found no sign that a wallet private key had leaked, and that the breach had additional points beyond the laptop.

Who Makes the Attribution

TRM Labs, a blockchain intelligence firm, assigns the theft to TraderTraitor “with high confidence”, based on on-chain and off-chain intelligence. TraderTraitor is a subunit of the Lazarus Group, the label for North Korea-linked hacking units, and is also tracked as Jade Sleet.

Jonathan Levin, co-founder of the analytics firm Chainalysis, said the theft was likely done by the group.

How the Theft and Laundering Work

The pattern is to target people and privileged systems rather than the blockchain itself. Cybersecurity Dive says this theft matches the Bybit and KelpDAO breaches, and TRM Labs links KelpDAO to the same pattern.

The February 2025 Bybit theft of about $1.5 billion was tied by the FBI to TraderTraitor, according to Nextgov and the Associated Press.

Turning Stolen Tokens Into Cash

According to a summary of TRM Labs findings, the attacker sold about 325 million USDT, a dollar-linked stablecoin, to market makers for about 122,300 ETH. The discount was more than 10%, a price criminals pay to swap tokens that issuers could freeze.

TRM estimates the attacker holds over 420,000 ETH and 18,270 BTC, about $2.4 billion beyond the reach of token issuers. The bitcoin is moving through a peel chain, a long series of small transfers that makes tracing slower.

Nextgov reports that $3.24 billion remains in addresses linked to the hack. He said funds not yet moved are very likely still held by North Korea, and that funds being laundered may already be with Chinese money laundering networks, which is opinion rather than proof.

Past Thefts and the Totals

Estimates of North Korean theft differ by firm, period and method, so each figure below carries its owner. They should not be added together.

• Chainalysis, 2026 Crypto Crime Report (December 2025): at least $2.02 billion stolen in 2025, up 51% on 2024, about 59% of more than $3.4 billion stolen worldwide.
• Chainalysis, same report: an all-time North Korean total of $6.75 billion.
• US intelligence, via Nextgov: at least $1 billion a year from crypto theft and financial crime for weapons programmes.

Cumulative totals also vary by source and date, and the Chainalysis figure predates the Binance theft. If TRM’s $6.36 billion figure holds, this would be a single theft nearly equal to everything North Korea had stolen in all prior years combined, per Chainalysis.

That comparison shows why analysts treat the case as a break from earlier thefts, though no one has yet reconciled the series.

The Denial, the Sanctions and the Stakes

Pyongyang’s Answer

UPI reports Kim Yo-jong suggested, without evidence, that the United States itself could be behind the attack, linking this to US plans to use confiscated crypto for a strategic reserve.

Who Is Who

• TRM Labs: a private blockchain analytics firm that attributes the theft to TraderTraitor and tracks the laundering.
• Chainalysis: a rival analytics firm whose annual report supplies the main yearly theft totals.
• FBI: the US federal investigator.
• Binance: the exchange that was hit, led by chief executive Richard Teng and co-founder and co-CEO Yi He.
• OFAC: the US Treasury office that imposes financial sanctions.
• Multilateral Sanctions Monitoring Team: a group of 11 states launched in October 2024 to monitor North Korea sanctions after Russia vetoed the UN Panel of Experts in March 2024 and its mandate ended in April 2024.

Sanctions and Freezes

The Korea Herald reported on 29 October 2026 a joint statement by South Korea, the United States, ten other countries and the European Union backing sanctions enforcement and citing findings on North Korean cyber activity and overseas labour. In March 2026 OFAC sanctioned facilitators of North Korean IT-worker schemes tied to nearly $800 million in 2024, The Block reported.

Headlines from around 29 October 2026 point to a further OFAC action on 10 individuals and an entity, but we could not read them, so the details are unconfirmed. The Korea Herald says Seoul has not yet decided whether to join additional sanctions.

Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council moved about 8,425 ETH and 74,559,805 ARB tokens into a frozen wallet. Binance puts the total frozen at about $3 billion.

Business Stakes

Teng said in a video on Friday 30 October that Binance will cover every dollar, and that customer funds were never touched. Binance has reserved over $6.34 billion, with $5 billion of it in the tokens taken.

Yi He said Binance is buying back the stolen altcoins using its SAFU fund and holdings. UPI says 90% was already replenished, but that conflicts with the freeze figures and is unverified.

Binance suspended withdrawals and deposits temporarily, though the Associated Press says deposits were unaffected. We found no figures in our research on Latin American exposure, so we draw no conclusions for the region.

Scenarios

One scenario is stabilisation: issuers and exchanges keep freezing funds, Binance honours its pledge, and the story fades into the sanctions record.

A tipping scenario would be rapid laundering of the unfrozen holdings through networks that US authorities cannot reach. A second would be sharper sanctions if Seoul and others join, which could harden the dispute instead of opening talks.

What It Means for You

If you hold crypto on a US exchange, the reported facts point to no loss at Binance, since it says customer funds were not touched and it will cover the shortfall. The practical risk is indirect, as exchanges face pressure to freeze or trace funds linked to sanctioned actors.

Investors and executives should note that the FBI and OFAC treat North Korean theft as a sanctions and national security issue. Any firm handling digital assets has reason to check whether its counterparties and wallets touch the addresses that US authorities publish.

What Is Not Known

The evidence behind TRM’s high confidence has also not been published in the material we reviewed. It is unknown how much will stay frozen or be recovered, and how much has already been laundered.

The full extent of the Binance breach beyond the laptop is also unclear. Kim Yo-jong offered no evidence for her suggestion about a US strategic reserve, so it has no established basis.

Nor is it known whether talks between the United States and North Korea are really in prospect.

What to Watch

We found no confirmed dates for the next steps in the research. Watch for further OFAC designations and the results of Binance’s own investigation.

A signal of talks from either capital would be the clearest sign of an opening.

Related reading: Why Legacy Bitcoiners Cheer ETF Outflows’ Promise; Between Faith and Fear: The Unseen War on Christians in Nigeria; Unyielding Faith: Inside the Global Struggle for Christian Survival in 2024; more from Crypto.

Frequently Asked Questions

Did North Korea hack Binance?

TRM Labs attributes the theft of about $6.3 billion to TraderTraitor, a Lazarus Group subunit, with high confidence. Pyongyang denies involvement.

How much crypto has North Korea stolen?

Chainalysis counted at least $2.02 billion in 2025 and an all-time total of $6.75 billion in its December 2025 report. Other firms give different totals, and the Binance theft would add to these figures.

How does North Korea launder stolen crypto?

According to TRM Labs, the attacker sold about 325 million USDT to market makers for about 122,300 ETH at a discount of more than 10%. The bitcoin is moving through a peel chain, a series of small transfers that slows tracing.

Will Binance customers lose money?

Binance chief executive Richard Teng said the exchange will cover every dollar and that customer funds were never touched. Binance has reserved over $6.34 billion, and says about $3 billion of the stolen assets is frozen.

What did Kim Yo-jong say?

UPI reports Kim Yo-jong suggested, without evidence, that the United States could be behind the attack.

What sanctions target North Korean hackers?

The Korea Herald reported on 29 October 2026 a joint statement by South Korea, the United States, ten other countries and the European Union backing sanctions enforcement and citing findings on North Korean cyber activity and overseas labour. In March 2026 OFAC sanctioned North Korean IT-worker facilitators, and Seoul has not yet decided whether to join additional sanctions.