TRM Labs Links Binance Security Incident to North Korean TraderTraitor Group

Binance has disclosed a security incident that it estimates affected approximately $6.3 billion in assets. The exchange said its initial investigation found that a compromised DevOps engineer laptop enabled unauthorized withdrawal transactions.

Blockchain intelligence firm TRM Labs said it attributes the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking group commonly associated with Lazarus Group. That assessment has not been publicly confirmed by Binance or by a government authority.

The incident was reported on October 29, 2026. Binance said user funds are safe and that losses would be covered through its SAFU fund and company funds.

Binance cites compromised DevOps laptop

According to Binance’s incident update, its initial investigation suggests that an attacker gained access through a compromised laptop used by a DevOps engineer. Binance said the access enabled entry to a service container and led to unauthorized withdrawal transactions.

Binance placed the estimated total impact at approximately $6.3 billion. That figure differs slightly from TRM Labs’ estimate of $6.36 billion, while other contemporaneous reporting cited lower totals. The varying estimates mean the final scale of the loss remains unclear.

The exchange said it would cover losses using SAFU and company funds. Its public update did not identify Lazarus Group, TraderTraitor, or any other specific actor as responsible.

• Binance estimated the impact at approximately $6.3 billion.
• Its initial account centers on a compromised DevOps engineer laptop.
• Binance said it would cover losses through SAFU and company funds.

TRM Labs makes TraderTraitor attribution

TRM Labs assessed with high confidence that TraderTraitor carried out the attack. The firm describes TraderTraitor as a North Korean state-sponsored group, and the group is commonly associated with Lazarus Group.

CoinDesk also reported that blockchain investigator ZachXBT and security researchers suspected Lazarus Group involvement. These are investigative and research-based assessments, rather than a public confirmation by Binance.

There is also a difference in the technical framing. Binance’s initial explanation focuses on the compromised laptop, service-container access, and unauthorized withdrawals. TRM Labs assessed the incident as a broader compromise involving hot-wallet signing infrastructure. The available evidence does not establish a single, confirmed account beyond Binance’s initial findings.

Attribution remains unconfirmed by Binance

The available information supports a distinction between the confirmed incident and the claimed attribution. Binance has confirmed the security incident, its preliminary pathway for unauthorized withdrawals, and its stated plan to cover losses.

The alleged connection to TraderTraitor or Lazarus Group remains an assessment from TRM Labs and other researchers. Further findings from Binance or official authorities could clarify both the scope of the compromise and responsibility for the attack.

The incident follows other security events affecting blockchain projects, including a reported exploit that led Initia to halt its blockchain and rollups. It also underscores why infrastructure access and transaction-signing systems remain central areas of operational risk for crypto platforms.

Continue reading: Initia halts blockchain and rollups after reported token-minting exploit on BTCNews.

Continue reading: Solana introduces Microscope for program monitoring and alerts on BTCNews.

Sources

• Binance: Security Incident Update
• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
• CoinDesk: Crypto's longtime foe, North Korea's Lazarus Group, likely behind Binance hack: blockchain sleuths
• Associated Press: Binance flags 'potential security issue,' says approximately $6.3 billion impacted

Our creator. Creates amazing NFT collections! Support the editor - Bitcoin_Man(TON) / Bitcoin Man Stickers(TON) / BM Numbers (TON) / Comics Book (TON) / Bitcoin_Man (ETH)

Pi Network (Guide)is a new digital currency developed by Stanford PhDs with over 55 million participants worldwide. To get your Pi, follow this link https://minepi.com/Tsybko and use my username (Tsybko) as the invite code.

Binance: Use this link to sign up and get $100 free and 10% off your first months Binance Futures fees (Terms and Conditions).

Bitget: Use this link Use the Rewards Center and win up to 5027 USDT!(Review)

Bybit: Use this link (all possible discounts on commissions and bonuses up to $30,030 included) If you register through the application, then at the time of registration simply enter in the reference: WB8XZ4 - (manual)