Researchers Link Binance $6.3B Hack to North Korea as Exchange Sets Aside $6.34B

The investigation into Binance’s massive crypto breach has taken a consequential turn. Blockchain intelligence firm TRM Labs says it attributes the theft to TraderTraitor, a North Korean hacking group, while Binance has reportedly put more than $6.34 billion aside to cover affected assets. Neither development settles the investigation. Binance has not publicly confirmed the attackers’ identity, and the value ultimately recovered may change as more assets are frozen.

This is a follow-up to TechBooky’s initial report on the $6.3 billion breach and withdrawal pause. The new question is how the attack was carried out across so many networks, what funds can still be clawed back and whether the exchange has enough immediately available assets to make customers whole.

In its technical analysis, TRM says about $6.36 billion moved from Binance-linked wallets across ten blockchains on October 29, most of it within roughly 20 minutes. It describes a coordinated operation that involved pre-arranged authorisations on Ethereum and signed transfers on other networks. TRM says its on-chain and off-chain evidence gives it high confidence that TraderTraitor was responsible. Chainalysis has also assessed that the same group was likely involved, according to the Associated Press.

That is a serious attribution by specialist investigators, not an official finding by Binance or a government. Binance told AP it is working with law enforcement to establish who the criminals are. It would be premature to present the North Korea link as a proven legal conclusion. The FBI attributed the 2025 Bybit theft to TraderTraitor, but a resemblance between incidents is not, by itself, proof of who conducted this one.

TRM’s account also complicates the early idea that a compromised laptop alone explains the incident. Binance has said its investigation uncovered additional points of breach. The full chain of access, from initial intrusion to wallet authorisation, has not yet been publicly established. That matters because an effective fix depends on knowing whether the failure sat with a person, a device, signing infrastructure or several controls at once.

Binance has promised to cover hacking losses. In an update shared with CoinDesk, the exchange said it had set aside more than $6.34 billion, including $5 billion in the same tokens affected by the attack. Binance also has its Secure Asset Fund for Users, or SAFU, alongside company resources. Allocating cover is an important reassurance, but it is not the same as showing that every impacted account has already been restored. Customers will need a clear timetable, asset-by-asset accounting and independent confirmation through the exchange’s promised updated proof of reserves.

Recovery remains fluid. Tether said it froze more than 1.567 billion USDT, while Circle confirmed freezing more than 800 million USDC, according to The Block. TRM says stablecoin issuers and network partners froze roughly $2.7 billion in all, while Binance has put the frozen amount closer to $3 billion. Those numbers reflect different snapshots and definitions, not necessarily a contradiction. Funds frozen on a blockchain do not instantly return to customers. A separate portion remains in assets that issuers cannot centrally freeze, making tracing and law-enforcement cooperation more important.

For users, the immediate priority is to follow Binance’s official withdrawal and account-status notices rather than messages claiming to offer faster recovery. A crisis of this scale creates opportunities for phishing and impersonation. The larger industry lesson is that an exchange can promise reimbursement and still face hard questions about how a coordinated, multi-chain withdrawal was authorised. The next credible update should explain both the restoration plan and what changed in its security controls.