The recent attack on Binance has once again put North Korean hackers in the spotlight. But are the stolen cryptocurrencies really funding the country?
In recent years, the cryptocurrency market has increasingly become a target for groups specializing in cyberattacks. North Korea is among the names frequently associated with these operations.
The issue has once again gained prominence following the October 29, 2026 attack on Binance, which reportedly resulted in the unauthorized movement of approximately $6.36 billion in crypto assets, according to blockchain analytics firm TRM Labs.
But there is an important question: there are indications that hackers linked to North Korea were involved. However, that does not mean the funds were sent to the country.
Let's take a look at what is known.
1. Who are the hackers associated with North Korea?
One of the groups frequently mentioned in this context is TraderTraitor, which security researchers have linked to North Korea.
This group is known for targeting cryptocurrency companies and platforms, using social engineering, system compromises and complex operations to gain access to digital funds.
Its activity has also been linked to the attack on the Bybit exchange in February 2025, in which approximately $1.5 billion in digital assets were stolen.
The FBI attributed that attack to North Korean actors. More recently, TRM Labs identified similarities and investigative evidence that led it to attribute the Binance attack to the TraderTraitor group with a high degree of confidence.
It is important to clarify that this attribution is based on analyses by firms specialising in blockchain intelligence. In itself, it does not amount to public confirmation by authorities that the North Korean government ordered the attack on Binance.
2. What happened in the Binance attack?
On 29 October 2026, unauthorised transfers of funds from Binance wallets were identified across several blockchain networks.
According to TRM Labs' analysis, approximately $6.36 billion was moved to addresses controlled by the attacker, mostly within a period of about 20 minutes.
The investigation identified transactions across ten blockchain networks, including #Ethereum #bitcoin #Tron #solana and XRP Ledger.
Binance said its preliminary investigation indicated that a DevOps engineer's laptop may have been compromised, allowing the attacker to access a service container and submit unauthorised withdrawal transactions.
The company also said that, up to that point, it had found no evidence that the wallets' private keys had been exposed.
TRM Labs, in turn, presented a technical analysis pointing to a possible compromise of the exchange's transaction-signing infrastructure.
The investigation is ongoing, and a definitive technical explanation will depend on further information.
3. Were the cryptocurrencies sent to North Korea?
This is probably the most important question, and also the one that requires the most care.
So far, there has been no public confirmation that the funds stolen in the Binance incident were transferred to North Korea or to accounts directly controlled by the North Korean state.
What blockchain analytics firms have been able to identify is the movement of assets to wallets controlled by the attackers.
TRM Labs also identified links between addresses associated with the attack and transaction patterns previously observed in operations attributed to North Korean groups.
Elliptic, another blockchain analytics firm, said it had identified funds from the Binance attack reaching the same address used to receive proceeds from a previous attack on the Bitget exchange, also suspected of involving actors linked to North Korea.
But be careful: a link between digital addresses can help identify connections between operations. It does not prove that the money reached North Korean territory, was received by the government, or directly funded any state activity.
Identifying who may be behind an attack is not the same as knowing the final destination of the funds.
4. Why are North Korean groups associated with cryptocurrency thefts?
North Korea is frequently mentioned in international reports on cybercrime involving digital assets.
US authorities and security researchers have linked operations by North Korean groups to cryptocurrency thefts and attempts to generate revenue through illicit digital activities.
One concern raised by these authorities is the possibility that funds obtained through these operations may help finance state activities, including military programmes.
Cryptocurrencies can be attractive for this type of operation because they make it possible to move assets across international networks without relying directly on traditional banking systems.
However, this does not mean that all transactions are anonymous or impossible to trace.
In fact, transfers recorded on many public blockchains can be analysed by researchers, security firms and authorities.
5. Is it possible to trace and freeze stolen cryptocurrencies?
Yes. The Binance incident itself demonstrates this.
According to TRM Labs, approximately $2.7 billion in assets related to the attack had been frozen by various entities by the time of its analysis.
The companies involved in the freezes included Tether, Circle and Ripple.
This is because certain digital assets, especially some stablecoins, have mechanisms that allow their issuers to block specific addresses.
But there is an important difference between tracing, freezing and recovering funds.
Trace: identify the movement of assets on the blockchain.
Freeze: prevent certain assets from being moved, when there is the technical capability to do so.
Recover: return the funds to the entity or their rightful owners, which may require additional procedures.
Not all cryptocurrencies have mechanisms for freezing them. As a result, recovering stolen funds can be a very complex process.
6. What does this case teach us about security in the crypto world?
The Binance incident offers some important lessons for investors, users and companies in the sector.
First: no platform is completely free from risk.
Even the largest exchanges can face technical vulnerabilities and sophisticated attacks.
Second: security does not depend solely on passwords.
Device protection, internal systems, access permissions and transaction approval processes are also essential.
Third: a public blockchain does not mean public identity.
It is possible to track a wallet and its transactions without immediately knowing who is behind it.
Fourth: staying informed and exercising caution remain essential.
Avoiding suspicious links, enabling two-factor authentication, protecting recovery phrases and being wary of messages promising to recover stolen funds are important precautions.
Conclusion: strong suspicions are not definitive proof
The attack on Binance has once again brought the role of hacker groups associated with North Korea in the cryptocurrency world into the discussion.
Analyses by TRM Labs and Elliptic point to possible links between the attack and North Korean actors. However, this does not allow us to claim that the stolen funds were sent to the country.
For now, all we can follow are the investigations, the transactions recorded on the blockchain and the efforts to freeze and recover the assets.
In the crypto world, a wallet can reveal a great deal about the path a transaction takes. But finding out who controls that wallet and who ultimately benefits from the funds is another story.
Do you think major attacks on cryptocurrency platforms are now one of the biggest challenges to the security of the digital market?
Share your opinion in the comments. Let's keep learning and following the facts without confusing suspicions with certainties.
Sources:
TRM Labs — Analysis of the Binance attack and attribution to the TraderTraitor group
Reuters — Blockchain analytics firm links Binance attack to North Korea
Elliptic — Analysis of the largest cryptocurrency theft and possible links to North Korea
Binance — Official update on the security incident