North Korea-linked TraderTraitor likely behind Rs 59,820 crore Binance hack

A North Korean cyber gang is reportedly behind Binance’s $6.3 billion hack. According to TRM Labs, "the largest bank heist in history" was the work of hackers belonging to the state-sponsored Lazarus Group. TraderTraitor, affiliated with Lazarus, broke into a Binance engineer’s laptop and gained control of billions of dollars worth of crypto in under 30 minutes.

The heist has sent the crypto markets into a tizzy, with concerns being raised about how the stolen funds would be recovered. Bitcoin was trading below $78,000 on Friday following the cyberattack. Meanwhile, Binance said that it has frozen around $3 billion in cryptocurrency assets. This means that the money cannot be transferred. However, recovering it is a different matter.

What Binance said about the hacking

"We have worked with blockchain partners to freeze the affected assets, with ~$3billion (£2.5bn) frozen on-chain so far,” Binance said, adding "user funds are completely safe". Its team is conducting security checks and working with law enforcement, during which time deposits and withdrawals have been suspended. Talking about what went wrong, the company said that an engineer's laptop was likely compromised, which led to unauthorised withdrawals.

Also Read: Binance under cyberattack? Crypto giants freeze more than $2.5 billion as Bitcoin drops over 3%

What is TraderTraitor?

TraderTraitor is a series of malicious software applications and a cyber-threat campaign operated by North Korean state-sponsored threat actors linked to the Lazarus Group / Reconnaissance General Bureau. TradeTraitor has been behind cyberattacks in the past. In February 2025, it was used to steal $1.5billion from the Bybit platform, which was the largest cyberattack till now. Blockchain investigation firm TRM Labs, citing "robust on- and off-chain intelligence," said it had "high confidence" that the campaign was responsible for the Binance hack as well.

It added that there were tell-tale signs in the heist that hint at North Korea's involvement. Tom Robinson, the founder of TRM, is almost sure that the cybergang was linked to North Korea because of the "similar tradecraft and co-mingling of funds from another hack attributed to them."

It primarily targets employees in the cryptocurrency, fintech, and blockchain industries. It reaches out to crypto platform employees via LinkedIn, Telegram, or Discord, impersonating recruiters. They get them to install malicious software on their systems, such as trading applications and fake PDF readers. Its primary objective is state-affiliated financial theft to generate revenue and bypass international sanctions.

The Lazarus Group once exacted revenge on Hollywood for mocking their leader Kim Jong Un. It was accused of hacking into Sony Pictures because its film, The Interview, made fun of the leader.