A North Korean hacking group has transferred about $6.36bn from Binance wallets.
According to TRM, the cryptocurrency was held on 10 blockchains, and the transfer was completed in 20 minutes, just after 8pm GMT yesterday.
In a post looking at the details of the attack, TRM said: “That makes this the largest crypto theft on record, about four times the $1.5bn Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.”
TRM attributed the attack to TraderTraitor, which it describes as an “elite hacking unit” based in North Korea. It appears that a Binance engineer’s laptop had been compromised, which gave the hackers access to the company’s internal systems.
The FBI has said TraderTraitor was responsible for the $1.5bn Bybit hack in February 2025. According to TRM, several features of this attack match previous North Korea-linked breaches, including the Bybit incident and the KelpDAO hack in April 2026, which it said involved small Tornado Cash withdrawals funding an operator wallet. “The laundering observed so far built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit,” it added.
Commenting on the attack, Raghu Nandakumara, vice-president of industry strategy at Illumio, who previously worked in network security and Citibank, said: “Strip away the record-breaking number, and the attack itself looks depressingly familiar. According to early reports, an engineer was talked into taking a ‘test’, and malware landed on their laptop while they did it. That laptop was already authenticated and already privileged, so it became the attacker’s route straight into production, and from there to the wallets.
“None of those steps are new,” he said. “What should concern every security leader is how rarely the attacker had to prove who they were. Once they had the laptop, every step after it relied on trust that was assumed instead of checked.”
While it is extremely hard to stop every social engineering attack, Nandakumara added: “You don’t have to prevent the first click to limit what it costs you. How far one compromised device can reach is an architectural decision, and it was made long before this attack.”
Nandakumara urged all organisations concerned about such attacks to ensure they build zero trust into the core of their security programme. In light of the attack, he recommended that IT security leaders “aggressively remove implicit, excessive access across identities, networks and data, starting with their most privileged users”.
Clive Summerfield, CEO of a biometrics in AI security company, FARx, said: “You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened. North Korea has a long history of social engineering. They don’t crack cryptography. They crack people.
“Most crypto platforms are as centralised as any bank, with a small number of privileged individuals controlling billions,” he said. “The difference is that once crypto is transferred, it’s gone. AI makes this worse. Criminals can, using deepfake technology, now clone a voice from seconds of audio, fake a video call with a colleague, and run social engineering at industrial scale.”
