TRM Labs, a blockchain intelligence firm that tracks the industry, has declared that an elite North Korean hacking unit called TraderTraitor was responsible for the security breach at Binance .
TRM Labs have also calculated that the breach is “the largest crypto theft on record”.
On October 29, 2026, an attacker moved approximately $6.36bn out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the $1.5bn Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.
TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.