A U.S. blockchain intelligence firm has attributed a record $6.36 billion cryptocurrency theft from Binance, the world’s largest cryptocurrency exchange, to a North Korean hacking group known as TraderTraitor, according to a report by Yonhap on October 30.

Hackers Stole Assets Across 10 Blockchain Networks

TRM Labs, the firm that conducted the analysis, said the attack was carried out across 10 blockchain networks. The stolen funds were taken in about 20 minutes, the firm added. It stated that it had “high confidence” the group was responsible, based on an analysis of cryptocurrency transactions and similarities with previous North Korean hacking operations.

The hackers are believed to have gained access to systems used to authorize cryptocurrency transfers, allowing them to move the funds without permission. The firm said the attack was prepared at least 36 hours in advance.

Part of the Stolen Funds Have Been Frozen

About $2.7 billion in stolen assets had been frozen through cooperation among cryptocurrency companies and blockchain operators, according to TRM Labs. However, the hackers still controlled roughly $2.4 billion worth of Bitcoin and Ethereum.

The firm warned that the hackers could attempt to obscure the origins of the stolen funds by moving them across different blockchain networks and cryptocurrency trading platforms.

North Korean Hacking Activities and U.S. Concerns

The attack would far exceed the $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025, which the U.S. Federal Bureau of Investigation attributed to the same hacking group, TraderTraitor.

U.S. officials have previously noted that North Korea relies on networks of its nationals abroad and foreign-based facilitators—including in China, Russia, Cambodia, and Vietnam—to launder stolen digital assets into fiat currency. These actions are used to fund procurement activities and weapons of mass destruction programs.