White House Withholds Blame as North Korea Linked to $6.4 Billion Crypto Heist
Binance confirms a major breach and states it has sufficient reserves to cover the loss, while independent firms attribute the theft to a North Korean-linked group.
By Riya Zhao ·
The largest digital asset theft in history has been confirmed by the world's top cryptocurrency exchange, yet the White House has declined to officially name the responsible state. President Donald Trump spoke to reporters in the Oval Office on October 30, stating that the investigation remains active. He told the Associated Press, “We do not know. We are analyzing the situation.”
The breach targeted Binance, which processes the highest volume of digital currency trades globally. According to TRM Labs, a U.S. blockchain intelligence firm, hackers stole approximately $6.36 billion from wallets connected to the platform. The funds were moved across 10 different blockchains. TRM Labs stated that the majority of the money was extracted within a 20-minute window.
TRM Labs attributes the attack to a hacking group known as TraderTraitor. The firm said it has a high degree of confidence that this group, which has links to the North Korean government, orchestrated the theft. Chainalysis, another leading blockchain analysis company, agreed with this assessment. Jonathan Levin, the chief executive of Chainalysis, publicly supported the theory that TraderTraitor was behind the incident.
Binance has not confirmed the specific identity of the attackers. A company spokesperson said the platform is working with law enforcement and partners to identify the culprits. The exchange stated it holds more than $6.34 billion in reserves to cover the stolen assets. Binance also reported that it has frozen approximately $3 billion of the stolen funds in coordination with other industry firms.
Richard Teng, a co-executive chair of Binance, explained that the attack likely began with a compromised laptop. Investigators later found additional vulnerabilities that expanded the scope of the incident. Teng confirmed that one of the exchange's hot wallets, which are connected to the internet for daily transactions, was affected. He noted that most assets are stored in cold wallets, which are offline and offer greater security.
Teng stated that the attack did not appear to be the work of a single individual. He said the attackers used sophisticated techniques, including a self-destruction mechanism designed to complicate forensic analysis. The company confirmed that customer deposits were not affected. Withdrawals were temporarily paused and the exchange expected to resume them within one or two days.
The potential North Korean connection aligns with a long history of cyber operations by the Pyongyang regime. South Korean intelligence estimated in December 2022 that North Korean hackers stole about $1.1 billion in crypto assets over the prior five years. This recent heist exceeds that total and is larger than the $1.5 billion theft from the Bybit exchange in February 2025, which the FBI attributed to North Korea.
Experts warn that the remaining unfrozen funds could be difficult to track. Garrick Hileman, an independent crypto analyst, explained that thieves may use mixers and other services to blend the assets. These tools obscure the origin of the funds, making it harder for investigators to trace the money.
