Between February 2025 and October 2026, attacks publicly tied to TraderTraitor, the North Korean unit inside Lazarus, took about $8.57B from crypto exchanges and bridges. Binance accounts for 74% of that sum. About 33% of the total is frozen, but almost all of it comes from one case.

Bybit, Feb 2025: $1.46B

A Safe{Wallet} developer's computer was hacked and malicious JavaScript was injected into the interface. Bybit's signers saw a normal-looking transaction and approved the drain of a cold wallet. About 3% was frozen. Within a month 86% of the ETH had been converted to BTC, most of it through THORChain. This is the only attack in the list with formal FBI attribution.

BtcTurk, Aug 2025: $48M

Hot wallets were breached, most likely through a stolen key. There is no data on frozen funds. Part of the stolen ETH later helped fund the Kelp attack.

Kelp DAO, Apr 2026: $292M

The attackers hacked two internal RPC nodes and DDoSed the external ones. The LayerZero bridge relied on a single verifier, which confirmed a fake burn. The Arbitrum Security Council froze about $71-75M (~25%). Around $220M has been laundered through THORChain, Wasabi, Tornado and Umbra.

AFX Trade, Jul 2026: $24.15M

A fake recruiter spent two weeks working with the team. A malicious git config gave the attackers the bridge validator keys. The stolen USDC became 12,467 ETH. Nothing has been recovered.

Bitget, Sep 2026: $387.5M

A zero-day in a third-party security product let the attackers forge withdrawal commands in the wallet system and wipe the logs. Every stablecoin was swapped within 41 minutes, so only $0.84M (0.2%) was frozen. $269M went through THORChain.

Binance, Oct 2026: $6.36B

A DevOps engineer's laptop led to a service container and then to signing access in the hot-wallet system across 10 chains. On Ethereum the attackers used 50 pre-signed EIP-7702 authorizations, after 36 hours of staging and test runs. About $2.7B (42%) is frozen: Tether ~$1.77B, Circle ~$825M, Ripple $40.5M, WLFI $27.8M, Arbitrum ~$30M. Roughly $2.4B in ETH and BTC is out of reach.

What the six have in common

• People, not code. None of the attacks used a smart contract bug. The way in was always a person or a piece of infrastructure.
• Stablecoins are the only thing that gets frozen. Binance's 42% exists because issuers caught about $2.66B in stables in time. Without Binance, about $117M of $2.21B was frozen, roughly 5%.
• THORChain is the exit. Loot from Bybit, Kelp, Bitget and Binance was moved to BTC through it.
• Weeks of preparation. Operator wallets funded through Tornado ahead of time, two weeks of social engineering at AFX, 36 hours of staging at Binance.

How solid is the link

Only Bybit has formal FBI attribution. The rest comes from analysts: TRM Labs, Elliptic and others. So far the link between the hacks rests on on-chain tracing: ZachXBT matched Binance and Bitget funds at one THORChain address. A shared laundering address points to one network, but it is not proof of one team.

Also linked: Phemex (~$85M, January 2025) sits just outside the window. MistTrack traced Binance funds to a wallet the Phemex hacker used before. With Phemex, the total is about $8.66B in 21 months.

Excluded: Drift ($285M, April 2026). TRM ties it to a different North Korean group.

Sums are at the time of each attack. Sources: TRM Labs, ZachXBT, Elliptic, BlockSec, MistTrack.

TraderTraitor hit Binance for $6.36B, the biggest crypto hack ever. Since Bybit in February 2025, the North Korean unit has taken about $8.57B in six attacks on exchanges and bridges. So far the link to these hacks rests on on-chain tracing: ZachXBT matched Binance and Bitget loot at one THORChain address.

Not one of them used a smart contract bug. Each started with people or infrastructure: a Safe{Wallet} developer's PC, a fake recruiter, hacked RPC nodes, a vendor zero-day and a DevOps laptop.

Only stablecoins get frozen. Most of Binance's frozen $2.7B (42%) is stables that issuers caught in time, while Bitget's attacker swapped them in 41 minutes and just 0.2% was stopped. Without Binance, 5% of the haul is frozen.

The supply chain scare around Southeast Asian reseller CryptoBilis has now reached Trezor. The hardware wallet maker published a security notice after a customer in Indonesia reported a hardware implant inside a Trezor Safe 5 bought from CryptoBilis via Tokopedia in August 2026.

The report describes an extra circuit board fitted between the main board and the screen, with a cellular module and an antenna. It allegedly reads what the screen shows, including the wallet backup, and sends it out over a mobile network when the device is plugged in. Trezor has not examined the device yet but treats the report as credible, saying the implant appears to work similarly to those found in tampered Ledger devices.

Anyone who bought a Trezor from CryptoBilis from March 2026 onwards is told to move funds to a new wallet with a new seed, and is eligible for a replacement device or voucher.

No loss of funds has been reported so far. CryptoBilis was removed as an authorized Trezor reseller on October 9, the day Ledger began investigating losses among its own CryptoBilis customers. Trezor also warns that scammers will likely exploit the incident with phishing emails, letters and calls.

Binance traced the breach to a compromised DevOps engineer's laptop: the attacker reached a service container and submitted withdrawals, with no private key leaked. The hit is now about $6.3B, and ~$3B is frozen on-chain, up from $2.54B earlier.

The trail points to North Korea's Lazarus Group, which would make it the regime's biggest heist, topping the $1.5B Bybit attack. Some of the stolen funds reached the same THORChain address as loot from the $388M Bitget hack.

Binance will cover all losses from SAFU and company funds. Deposits work, withdrawals should resume within 48 hours, and today's PREDICT spot listing is postponed.

Shortly after Binance put the impact of its security incident at $6.3B, on-chain investigator ZachXBT traced part of the stolen funds to an address that also holds Bitget exploit proceeds. Both flows arrived via THORChain before being commingled at 0x15104a9c...feb7.

Pooling proceeds from two separate incidents in a single wallet indicates the same actor is likely behind both the Binance breach and the $388M Bitget exploit.

The Bitget exploit was attributed to DPRK-linked TraderTraitor, a group whose activity also overlaps with earlier incidents such as the $292M Kelp DAO exploit.

Binance has said roughly $3B of affected assets are frozen with partners and pledged to cover all user losses. A confirmed link would tie the largest crypto heist on record to the same DPRK-linked group.

Deposits on Binance continue to operate as normal, while the exchange works on enhancements to its withdrawal service and address controls. Co-founder Yi He said withdrawals are expected to begin resuming within the next 48 hours.

The pause followed a security incident with an estimated total impact of about $6.3 billion, which analysts called potentially the largest crypto heist on record. Binance said its initial investigation points to a compromised laptop of a DevOps engineer that may have let an attacker submit unauthorized withdrawals, with no evidence that wallet private keys were exposed.

About $3 billion of the affected assets has already been frozen, including nearly $1.57 billion by Tether, more than $800 million by Circle and roughly $200 million by Ripple.

Binance said users will not bear the losses, which it plans to cover through its SAFU fund and company capital, and promised an updated Proof of Reserves once the incident is resolved.

Attention around Thursday's Binance breach has shifted from frozen funds to attribution: several blockchain sleuths and analysis firms point to North Korea's Lazarus Group as the likely attacker. No official attribution has been made so far.

Binance estimates the incident's impact at $6.3B, with around $3B in crypto assets frozen. Its initial findings point to a compromised DevOps engineer's laptop that let the attacker reach a service container and submit unauthorized withdrawals. The exchange says it will cover all losses through its SAFU fund and company money.

If confirmed, it would be the regime's biggest crypto heist, roughly 4x the $1.5B taken from Bybit in 2025.

The attribution adds to a run of large exchange breaches: in September, Bitget lost more than $350M in a theft it also suspected North Korea of carrying out. Funds that are not yet frozen remain the main recovery risk.

Predict (PREDICT), a prediction market on BNB Chain, was set to open spot trading on Binance against USDT, USDC and TRY at 10:00 UTC on October 30. The exchange has now postponed the trading start until further notice, with no new date given.

The delay comes as deposits and withdrawals on Binance remain suspended after a security incident that the exchange ties to a compromised DevOps engineer's laptop. The attacker used it to reach a service container and submit unauthorized withdrawals; Binance says it found no sign of a private key leak.

Binance estimates the total impact at around $6.3B, with about $3B frozen on-chain so far, and says all losses will be covered from the SAFU fund and company funds.

Predict.fun had its own breach earlier this week, when about 400,000 USDT was taken from a small number of user wallets through its third-party-hosted API documentation site.

Binance has shared the first findings of its investigation into the security incident. The attacker reportedly gained access through a DevOps engineer's laptop, reached a service container and used it to submit unauthorized withdrawal transactions. The exchange said it found no evidence that any wallet private key was leaked.

Binance now estimates the total impact at around $6.3B, with about $3B frozen on-chain together with blockchain partners.

Deposits and withdrawals remain suspended while security checks continue, and the affected address authorization has been revoked. Binance said all losses will be covered by the SAFU fund and company funds, and that it will publish an updated Proof of Reserves after remediation. A full technical post-mortem is promised once the facts are verified.

Binance 14, the hot wallet at the center of Thursday's suspected hack, is listed in the exchange's October 1 proof of reserves as backing customer balances. At the time it held 1.26B USDT and 89,475 ETH among 37 assets.

The attacker used EIP-7702 to turn the wallet into a sweeper that forwarded incoming funds to their own address. About 167,464 ETH left Binance 14, followed by 28,005.6 ETH from Binance 16.

Roughly 204,500 ETH taken equals about 5.6% of Binance's ETH reserves, leaving ether backing near 94% after an exact 100% ratio on October 1.

USDC and several altcoins, including ENA, UNI, PEPE and AAVE, are also likely below full backing until the stolen assets are replaced. Binance says customer balances will be honored, its SAFU fund holds around $1B in bitcoin, and the November 1 reserve snapshot will show whether the gap has been closed.