How North Korea Stole $6.3 Billion From Binance in 20 Minutes

The October 29 Binance hack drained roughly $6.3 billion in 20 minutes, according to the episode’s framing; John T’s tally across Binance hot wallets on Ethereum, Bitcoin, Tron, Solana, and other chains was about $6.4 billion. Laura Shin described it as the largest hack in history. John T attributed the incident to TraderTraitor, a North Korean-linked operation, while the precise entry point and mechanics remained unconfirmed.

Binance initially said a possibly compromised DevOps engineer’s laptop may have provided access to a service container, enabling unauthorized withdrawals; it said it had found no evidence that wallet private keys were leaked. Pablo Sabatella described a possible chain of events in which an infected laptop gave an attacker access to internal systems, followed by lateral movement and privilege escalation. He said nine out of ten major attacks he had observed in the prior three years began with an infected laptop. One unconfirmed scenario involved pre-signing 50 transactions, using one to turn a hot wallet into a contract-controlled smart account, then sweeping its assets, including deposits arriving during the theft.

The speakers said EIP-7702 did not cause the breach, though it may have helped speed up asset movement. John characterized the incident as an operational-security failure, potentially involving malware or social engineering. The many affected chains and assets—including XRP, Ethereum, Arbitrum, Avalanche, Optimism, Base, Tron, Solana, Polygon, and stablecoins—were seen as pointing to compromised signing infrastructure rather than direct use of stolen private keys. Binance later reported additional breach points and said it was still gathering facts with law enforcement.

Speakers estimated that about 43% of the stolen funds had been frozen, while other descriptions put the share at roughly half, or about $3 billion. Circle, Tether, and the Arbitrum Security Council took freezing actions; one speaker called the recovery unprecedented compared with less than 3% frozen initially after the Bybit incident. They disagreed on whether Circle’s business relationship with Binance affected its response. The subsequent laundering raised concerns about DeFi liquidity: swaps totaling roughly $6.4 billion could overwhelm markets, some trades reportedly lost as much as 10%, and searchers and builders were said to have made about $50 million. Sabatella said North Korea was moving funds toward Bitcoin and Ether because USDT and USDC can be frozen, and argued that DeFi protocols should consider circuit breakers for unusually large movements.

John T said TraderTraitor takes its name from the group’s early use of trojanized crypto-trading apps. Its social engineering has included fake job interviews and coding tests designed to persuade developers to run malicious code, sometimes on corporate laptops. He described “Lazarus” as an umbrella label for multiple North Korean cyber operations, not a single group, and said North Korea’s Reconnaissance General Bureau had shifted substantial personnel toward cryptocurrency targets over roughly five to seven years. He said laundering likely involves third-party money-laundering organizations, often Chinese-speaking, rather than North Korean operators moving the funds themselves. Rapid, scripted transfers are intended to obscure their origin and evade monitoring; analysts had seen such automation since at least 2020, but AI use in this case was unconfirmed.

Thorchain became a central point of dispute because speakers said more than 99% of its transaction volume on some days involving North Korean-linked laundering may have been related to laundering. After a solvency checker detected a shortfall, node operators halted transaction signing across multiple chains within two minutes; three votes were sufficient to trigger the halt, and restarting required a node vote on a protocol upgrade. A prior Ethereum block reorganization had caused a vault to pay out 10 ETH it had not received; the recipient later returned it. Speakers questioned how decentralized Thorchain was, citing approval requirements for prospective node operators, voting coordination, and two admin keys that could unilaterally freeze the protocol. Those keys were reportedly used during an incident that caused losses and have since been removed. The FBI, U.S. Secret Service, and IRS Criminal Investigation asked crypto services to block addresses allegedly used by North Korean actors, naming Thorchain; one speaker called the request a warning shot with serious national-security implications.

Sabatella warned that AI could accelerate vulnerability discovery and urged organizations to assume any device, account, key, server, API key, or email might be compromised, using compartmentalization and endpoint detection and response on managed devices. He estimated that 90% of crypto organizations lack real operational-security expertise. Chainalysis was cited as reporting that suspected North Korea-linked attacks accounted for nearly 89% of reported crypto hack losses in 2026 year to date, versus 15% in 2021, while average losses per suspected DPRK-linked hack rose from $50 million to $185 million. The host cautioned that the increase could reflect both North Korea’s improving record and industry growth.