North Korea Linked to Binance's $6.3 Billion Hack, the Largest Crypto Theft on Record

Binance lost an estimated $6.3 billion in cryptocurrency on October 29, the largest theft in crypto history, after an attacker compromised the exchange's wallet signing infrastructure and swept funds across ten blockchains in roughly twenty minutes.

TWENTY MINUTES, TEN BLOCKCHAINS

Binance said its initial investigation pointed to a compromised DevOps engineer's laptop that gave an attacker access to a service container capable of submitting withdrawal transactions, and that it had found no evidence of a leaked private key. Co-CEO Richard Teng later walked the simplicity of that story back, saying the attacker did not merely use one engineer's permissions and that the breach involved a more complex process with additional points of entry still under review.

On Ethereum, the attacker turned a Binance hot wallet into a sweeper it controlled by using an EIP-7702 delegation, with fifty pre-signed authorizations prepared in advance, while wallets on nine other chains sent funds out through ordinary signed transfers. Preparation reportedly began more than a day before the theft, including small test withdrawals through the mixing service Tornado Cash.

THE NORTH KOREA ATTRIBUTION

Blockchain intelligence firm TRM said it assessed with high confidence that the attack was carried out by TraderTraitor, a North Korean hacking unit linked to the Lazarus Group, and Chainalysis reached the same conclusion, with its co-founder and CEO Jonathan Levin writing that the Binance hack was likely the work of the North Korean group. The FBI had already blamed the same unit for the $1.5 billion Bybit hack in February 2025, and independent investigator ZachXBT separately pointed to Lazarus as the likely culprit. Binance itself has not confirmed the attribution, saying only that it is cooperating with law enforcement.

The scale sets a grim new record. Lazarus previously orchestrated the $1.5 billion Bybit hack in February 2025, then the largest crypto theft in history, and this attack dwarfs that record.

THE FREEZE RACE

Stablecoin issuers moved fast once the theft was confirmed. Tether's Paolo Ardoino said the company froze more than 1.567 billion USDT tied to the hack, framing it as protecting the industry and its partners, while Circle's Jeremy Allaire said his company froze more than 800 million USDC in coordination with law enforcement. Binance said roughly $3 billion had been frozen on chain in total and pledged to cover every remaining loss through its SAFU emergency fund and corporate reserves, adding that user funds were safe and that a fuller technical postmortem would follow once the investigation was complete.

CZ, ELON MUSK, AND A BILLION DOLLARS OF SPACEX STOCK

The fallout produced an odd sideshow. After Elon Musk posted a string of mocking emojis about the hack, Binance co-founder Changpeng Zhao reminded him that Binance's equity stake in SpaceX, which stems from an earlier investment in Musk's Twitter takeover, is worth more than a billion dollars. "Elon, have a lot of respect for you, but bad time to troll. Please stop," Zhao wrote, adding that the SpaceX shares were worth more than a billion dollars and asking Musk to "show a little support." Binance co-CEO Yi He followed up with her own message, saying the company's annual revenue was sufficient to cover the losses so it did not need to sell the stake Zhao had just name-dropped.

BITCOIN HOLDS WHILE THE EXCHANGE BURNS

Bitcoin's price fell about 5 percent after the news broke, dropping below $77,000, a move traders widely read as a confidence shock to a centralized exchange rather than any flaw in Bitcoin itself. The theft targeted Binance's internal wallet infrastructure, not the Bitcoin network, and the protocol itself processed the hacker's transactions exactly as it processes everyone else's: it does not know or care who is sending the money. For an industry that spent the back half of this year absorbing a Coldcard firmware flaw and a tampered hardware wallet reseller, a familiar lesson repeats. The risk was never in Bitcoin's code. It was in who else was allowed to hold the keys.

This story comes from the Simply Bitcoin Live show. Watch the full episode.