KelpDAO

Binance Suffers Record $6.3 Billion Hot Wallet Theft Attributed to North Korean TraderTraitor Group

On October 29, 2026, Binance disclosed that attackers had drained approximately $6.3 billion in digital assets from its hot wallets, far exceeding the previous record of $1.5 billion stolen from Bybit in February 2025. The FBI attributed the operation to the TraderTraitor group, widely identified as the North Korean Lazarus Group, which converted stolen tokens into Ethereum and prepared to launder proceeds through decentralized finance platforms and instant exchangers. Binance stated that 90 percent of losses were covered using its SAFU reserve, futures insurance fund, and corporate treasury totaling roughly $6.34 billion, though this represents replenishment rather than recovery of assets from the attackers. The breach originated from a compromised DevOps engineer's laptop that granted access to signing infrastructure, with additional malware used to erase forensic traces; blockchain analysis by TRM Labs linked the timing and tactics to prior campaigns against Bybit and KelpDAO. The incident contributed 2.3 percentage points to the Cassandra Index, pushing the weekly score to 72 and driving the largest regional increase in East Asia. The theft underscores how North Korean state actors rely on cryptocurrency operations to fund weapons programs despite international sanctions.