North Korea’s TraderTraitor unit suspected in $9 billion Binance cryptocurrency hack, marking historic cyber attack
Analysts suspect the North Korean cyber unit TraderTraitor may be behind the incident due to their history of similar attacks.
According to TRM Labs, this assault resembles a 2025 incident involving another exchange, Bybit, also attributed to North Korea.
Cyber attack details
Investigations suggest that the breach began with a compromised laptop belonging to a Binance engineer.
A report indicates that hackers accessed Binance’s systems, facilitating unauthorised withdrawals.
The US Cybersecurity and Infrastructure Security Agency has reported that TraderTraitor has been targeting cryptocurrency firms since 2020.
Binance has assured customers that their funds remain secure and has initiated efforts to recover $4.2 billion that was frozen post-attack.
The company committed to covering the losses through its own resources and maintains enough assets to handle the incident.
Approximately half of the stolen cryptocurrencies have been frozen by their issuers, but around $3.4 billion remains unaccounted for.
Chainalysis reported that the stolen funds are being laundered and obfuscated through automated processes.
Binance, founded in 2017, operates as a major cryptocurrency exchange, facilitating various transactions.
The platform has previously faced breaches, including a $40 million theft in 2018 and another incident in 2022 amounting to $808 million.
