North Korea Targets Crypto Firms, Binance Hack Exposed

Five ways North Korea breaks into crypto firms—and what the Binance hack revealed

A record-setting cryptocurrency theft at Binance has intensified scrutiny of how North Korea-linked operators penetrate major crypto companies. U.S. authorities and blockchain analysts say the October 29, 2026 incident resulted in the theft of more than $6 billion in virtual assets, making it the largest known crypto heist to date.

The Federal Bureau of Investigation said North Korea was responsible for the Binance theft and linked it to a named cluster of malicious cyber activity it calls “TraderTraitor.” The FBI also published a list of blockchain addresses tied to the stolen funds.

Reuters separately reported that hackers stole $6.3 billion from Binance in the attack, citing analysis that attributed the incident to North Korea. Reuters also noted that some stolen stablecoins have been frozen, potentially limiting how easily part of the haul can be moved, while other funds remained unaccounted for at the time.

How Binance was breached: investigators described an intrusion that began with access to one engineer’s laptop. From there, the attacker hijacked internal systems and began issuing unauthorized withdrawals across 10 different digital networks.

According to TRM’s analysis of the Binance incident, the attacker used 50 pre-signed authorizations on Ethereum. TRM assessed the attacker likely gained the ability to make Binance’s hot-wallet signing system sign across chains—a type of infrastructure compromise that can turn routine operational tooling into a high-speed theft mechanism.

The Binance incident fits a broader pattern: rather than attacking blockchains directly, North Korea-linked actors repeatedly focus on the people and systems that control private keys and transaction approvals.

TRM and other investigators point to multiple recurring entry paths used against crypto firms, ranging from social and operational pressure to technical sabotage:

• Targeting employees and trust relationships: TRM analysts assessed that in 2026, North Korean proxies reportedly met Drift employees in person over several months before an April theft.
• Compromising infrastructure used for signing and approvals: At Binance, TRM assessed the attacker likely gained cross-chain signing capability after leveraging pre-signed authorizations.
• Poisoning internal nodes and overwhelming external systems: In the KelpDAO theft, attackers poisoned two internal RPC nodes and overwhelmed external nodes with traffic.
• Using deception at the identity layer: Investigators and security researchers have flagged tactics such as AI-driven deepfakes to help adversaries pass checks and build credibility.
• Inserting malicious code into software supply chains: One widely discussed approach is poisoning code libraries to create quiet, persistent access inside a company’s environment.

Why it matters: the scale of the Binance theft has renewed questions about operational security at centralized exchanges and other crypto businesses that manage large, frequently used “hot” wallets. When signing systems or internal authorization paths are compromised, attackers can potentially turn legitimate processes into automated withdrawal pipelines.

The Binance incident also illustrates why attribution and enforcement actions have become central to the industry’s security response. In addition to naming “TraderTraitor,” the FBI released wallet addresses associated with the theft to support tracking and mitigation efforts.

The broader context: North Korea-backed hackers have stolen an estimated $12.8 billion in crypto across 100 incidents since 2017, according to TRM’s assessments. TRM estimates $7.4 billion of that total occurred in 2026 alone.

TRM further assessed that North Korea accounts for 85% of all crypto hack value worldwide in 2026 year to date, up from 7% in 2020. As of October 2026, TRM said the majority of that value is driven by the Binance theft.

TRM also found that a small number of major infrastructure compromises drove most of the total stolen since 2017. The Binance, Bybit, Ronin, Bitget, and DMM Bitcoin hacks collectively account for $9.1 billion of the $12.8 billion total attributed to North Korea.