Crypto hacks: North Korea has stolen $9.6 billion since 2019, Binance accounts for two thirds of it

Coin Encyclopedia Improve your knowledge of cryptos

The unfolded data account did the math on October 30 and arrived at approximately $9.6 billion in crypto hacks attributed to North Korea since 2019. Have you been following the Lazarus group for years? A single evening was enough to rewrite the ranking, since the Binance heist the day before represents two thirds of it.

On October 29 around 9:05 p.m. (Paris time), Binance hot wallets were emptied on around ten blockchains. These connected wallets are used for routine withdrawals from the platform. Most of the loot was gone in around twenty minutes according to TRM Labs.

The procedure consists of one transaction. The attacker submitted 50 pre-signed authorizations leveraging EIP-7702, an Ethereum feature activated in May 2025 that allows a traditional wallet to execute code. The Binance wallet turned into a vacuum cleaner and 167,464 ETH left the platform at once, along with 1.6 billion USDT.

Binance discusses a DevOps engineer’s compromised computer. No private key would have leaked.

The amount varies depending on the analysis houses. Chainalysis holds $6.4 billion, TRM 6.36 billion at the moment and Binance itself around 6.3 billion. The decimal doesn't matter. The nine biggest hacks in crypto history combined, from Mt. Gox to FTX to Bybit, total $5.4 billion. The Binance theft alone exceeds this billion total.

Take out Binance and the North Korean counter drops to $3.2 billion over six years. The unfolded table lists the targets with Upbit in 2019 for 49 million, Axie Infinity's Ronin bridge in 2022 for 624 million, Harmony the same year, Atomic Wallet in 2023, then Bybit in February 2025 for 1.4 billion according to DefiLlama.

The year 2026 picks up the pace. Drift (295 million) and Kelp DAO (293 million) fell this year, then Bitget last month for 387 million.

Funds stolen from Bitget were mixed with those from Binance at a common address. It is on this basis that Chainalysis attributes the attack to TraderTraitor, a North Korean cell linked to Lazarus. TRM Labs comes to the same conclusion “with a high degree of confidence”.

Elliptic is more cautious. The firm considers the attribution “probable”, not certain, because the overlap only concerns $39,000 of Binance funds. No government has confirmed. The FBI, which designated TraderTraitor for Bybit in five days, is silent for the moment. Unfolded itself specifies: for Binance, Bitget and Drift, the attribution comes from security firms, and Drift could report to a North Korean unit separate from Lazarus.

Machine-translated from French