Investigators suspect that North Korea's "Lazarus" group is involved in the $6.3 billion Binance hack incident

Blockchain investigators have linked the hack of Binance to North Korea's “Lazarus” group, suspecting that this state-backed hacker gang stole approximately $6.3 billion from the cryptocurrency exchange on October 29th.

• TRM Labs indicates a high degree of certainty that the $6.3 billion Binance hack incident is attributed to the North Korean hacking unit TraderTraitor.
• Blockaid, co-founder and CEO of a blockchain security company, along with Ido Ben and Natan, stated that attackers transferred at least $3.5 billion across four blockchains in less than an hour.
• Investigators traced and found that this theft was related to the breach of transaction signature control, which included 50 Ethereum authorizations targeting a hot wallet.
• Binance claims to have frozen approximately $3 billion in assets and promises to cover customers' losses.
• During the security upgrade period, withdrawals will still be suspended. Binance expects to resume services within 48 hours.

TRM Labs indicates that their investigators are highly confident in attributing this attack to TraderTraitor. This organization is a North Korean hacking unit associated with Lazarus. Blockchain investigator ZachXBT also separately determined that Lazarus is likely to be the attacker, however, Binance has not yet confirmed who carried out this theft.

In an interview with crypto.news, Blockaid co-founder and CEO Ido Ben - Natan stated that the scale of this attack exceeds that of any previous cryptocurrency theft incidents.

Ben-Natan said, "This is the largest hacking incident in the history of the cryptocurrency industry. Our analysis shows that in less than an hour, at least $3.5 billion was transferred from Binance's hot wallets on Ethereum, Arbitrum, Optimism, and Avalanche. This amount is more than twice that of the theft case in February 2025 involving Bybit."

He also stated that investigators have discovered additional transfers involving Bitcoin and Polkadot, and his team is still working to track down the stolen assets.

Meanwhile, the on-chain tracking platform Onchain Lens reported that the attackers from Binance transferred 17,260 ETH to a new wallet, worth approximately $38.82 million at that time. There are concerns that these funds may be laundered through Tornado Cash or other cryptocurrency mixers.

According to the data from this tracking platform, the attackers still control nearly 480,720 ETH, worth 1.08 billion US dollars, and these assets cannot be frozen by the token issuer. The recipient wallet address has been identified as 0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea.

The Binance hack affected ten blockchain networks, and the Lazarus organization is under suspicion

According to a survey by TRM, approximately $6.36 billion was transferred out of wallets controlled by Binance, involving ten blockchain networks, including Ethereum, Bitcoin, Polkadot, Solana, and XRP Ledger.

Most of the stolen funds were transferred within about 20 minutes, starting at 20:05 Coordinated Universal Time (UTC). Of this amount, approximately $3.79 billion was transferred via Ethereum, while Bitcoin and Tron accounted for $1.47 billion and $628 million respectively.

Investigators found that before the Ethereum attack began, 233.46 million XRP tokens, valued at nearly $296 million, had been transferred out of five Binance wallets.

The security company stated that the relevant preparatory work had begun at least 36 hours before the theft occurred. A wallet controlled by the attackers received three small withdrawals from Tornado Cash and tested the malicious code before locking Anbin.

According to TRM, these activities are linked to TraderTraitor through blockchain transactions and other intelligence, but not all evidence for attribution has been publicly disclosed.

The Federal Bureau of Investigation (FBI) had previously determined that TraderTraitor was responsible for the theft on Bybit in February 2025, during which approximately $1.5 billion in assets were transferred from that exchange. U.S. authorities accuse North Korean hackers of using cryptocurrency theft to fund the country's weapons programs.

Blockaid Explains How Attackers Gain Access to Binance Wallets

Technical investigations by Blockaid have revealed that an abnormal Ethereum transaction contained 50 EIP-7702 authorizations, targeting Binance 14, which is one of the busiest hot wallets on that exchange.

EIP-7702 Allows an Ethereum wallet to authorize smart contract code to perform operations on its behalf. Attackers prepared these authorizations in advance using 50 consecutive transaction counters, thereby increasing the probability that one of them would match the wallet's current counter.

In the end, only one authorization was successful, but that was sufficient for the malicious contract to transfer assets from that wallet.

Ben-Natan explained to crypto.news: 'The attackers actually reprogrammed one of Binance's main Ethereum hot wallets, allowing a single operator to empty its contents, including any new funds that were subsequently deposited.'

The attacker transferred approximately $2.5 billion from Binance, which included 167,464 ETH and over 1.6 billion USDT. Subsequent transfers also targeted newly received funds.

Investigators also found that other Binance wallets transferred assets across multiple networks through regular signature transactions. TRM believes that the attackers may have gained access to the exchange's transaction signature infrastructure.

Binance claims it may be related to a breach in a laptop, and has frozen $3 billion

In a security update, Binance stated that preliminary investigations indicate that the laptop of an engineer with the username DevOps was compromised, which may have led to unauthorized access to an internal service container.

The exchange stated that no evidence of private key leakage was found and mentioned that they would announce the detailed investigation results after identifying the cause.

Tether CEO Paolo Ardoino confirmed that over 1.567 billion USDT have been frozen; Circle CEO Jeremy Allaire stated that over 800 million USDC have been frozen. The Arbitrum Security Committee has protected approximately 74.6 million ARB and 8,425 ETH related to the attackers.

Binance withdrawals are still suspended.

Binance stated that it will utilize its SAFU fund and company resources to cover the losses, while also cooperating with law enforcement authorities and blockchain investigators.

Meanwhile, the exchange stated that the recharge function is still operational, but during the upgrade of the withdrawal system and address control measures, withdrawals will continue to be suspended.

Binance expects to resume withdrawals within 48 hours and stated that it will subsequently release a comprehensive report on the cause of this attack.

After the hack incident, the cryptocurrency market also faced selling pressure, with Bitcoin briefly falling below $77,000. The total settlement amount in the derivatives market within 24 hours exceeded $1.5 billion.