Source: AlamyOn 30 October, crypto exchange Binance announced that a security incident had led to unauthorised withdrawals affecting around US$6.3 billion. Crypto research firm Elliptic has stated that this is the largest theft of any kind in history. The scale of the alleged theft is shocking, but what is also concerning are reports that actors connected to the Democratic Republic of North Korea may be responsible. Linking the theft to North Korea came from analysis of the laundering network that the culprits used, which is the same Chinese-language underground banking system that serves online fraud compounds in South East Asia.Gone in 20 MinutesOn 29 October, it took less than four hours for $6.3 billion to be stolen from Binance, with most of the cryptocurrency gone in 20 minutes (TRM Labs, 29 October 2026). Between 8.04pm and 11.56pm, the crypto was transferred via the Binance withdrawal system after a compromised engineer’s laptop as well as “additional points of breach” allowed access to the company’s systems. $2.7 billion was frozen by Tether, Circle, Arbitrum and four smaller issuers, but $ 729 million was swapped into other cryptocurrencies, and $3.2 billion remains with wallets controlled by the culprits (Bitquery, 30 October 2026).To put the theft into perspective, in September Binance was reported as holding $165.12 billion in reserves, by far the largest of all of the major crypto exchanges. Of that total, $ 57.56 billion was in Bitcoin, $10.73 billion in Ethereum, $44.74 billion in stable coins, $33.45 billions of BNB, the Binance ecosystem token, and around $18 billion in other crypto currencies. During September alone, eleven tracked crypto exchanges processed an extraordinary $4.83 trillion in transactions (Coin Market, September 2026).The nature of the Binance holdings matters to the impact on crypto markets. The data above shows that approximately 20% of Binance’s reported cryptocurrency reserves were in tokens whose market value could be adversely affected by a crisis involving Binance itself. The tokens are of course not owned by Binance, but by its customers, and the scale of the loss will be challenging for Binance to cover with its own liquid capital reserves. If Binance cannot cover the losses and if the firm consequently fails, then the entire global crypto market will be impacted.North Korean CybercrimeOn 27 October, two days prior to the theft, Binance had reportedly announced that its security team had successfully blocked multiple North Korea-linked cyberattacks during the preceding week without any damage to company systems or loss of assets. As reported by TechFlow, “Binance noted that hacker groups associated with North Korea have been continuously conducting social engineering attacks under the name “Contagious Interview” utilizing scenarios such as fake recruitment interviews, code tests, and software installations to lure targets into running malicious programs.”Direct attribution of the theft itself to North Korea has been made by TRM Labs, who have accused TraderTraitor, a North Korean premier hacking operation, of responsibility. According to TRM Labs, features of the Binance theft are similar to earlier North Korea linked operations, including the Bybit hack and the KelpDAO hack in April 2026, including “small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst.” (TRM Labs, 29 October 2026)The FBI, Cybersecurity and Infrastructure Security Agency (CISA), and the U.S. Treasury Department used the term “TraderTraitor” in April 2022 to describe a North Korean cybercrime campaign involving malicious software disguised as legitimate cryptocurrency trading and price prediction applications. The attackers adapted publicly available software to create convincing applications that in advertising appeared to be genuine cryptocurrency investment and trading services. Once installed, the applications could compromise victims’ computers and provide the attackers with access to sensitive information and systems. TraderTraitor is not a group, but an operational cybercrime campaign. According to the US authorities, TraderTraitor is associated with the Lazarus Group and North Korea’s Reconnaissance General Bureau (FBI, CISA, CSA, April 2022).In December 2024, the FBI, Department of Defense Cyber Crime Center, and National Police Agency of Japan issued a joint statement attributing the theft of cryptocurrency worth $308 million from the Japan-based cryptocurrency company DMM to “TraderTraitor threat activity… which is often characterized by targeted social engineering directed at multiple employees of the same company simultaneously.” (FBI, DC3, and NPA, 23 December 2024). The Japanese NPA also stated that TraderTraitor is considered as a part of the “Lazarus Group”, which is believed to be a subordinate organization of the North Korean authorities (NPA, undated).In February 2025, the FBI stated that the TraderTraitor operation from North Korea was responsible for the theft of around $1.5 billion in virtual assets from crypto exchange Bybit (FBI, February 2025). According to the Bybit security incident report, on 21 February 2025 a hacking incident affected an Ethereum wallets and resulting in almost $1.5 billion in losses; Bybit attributed the exploit as being linked to the North Korean state-backed Lazarus Group (Bybit, 3 March 2025).These cases are part of long established operations conducted by North Korea using criminal methods for revenue. In 2025, the Multilateral Sanctions Monitoring Team (MSMT)[1] reported that in 2024 North Korean cyber actors stole $1.19 billion in cryptocurrency from companies around the world, and from January to September 2025 stole at least $1.65 billion (largely related to the Bybit theft). The MSMT found that North Korea launders stolen cryptocurrency before attempting to convert it into fiat currency that is then used for funding its unlawful nuclear and ballistic missile programs (MSMT, October 2025).The North Korean cyber operations of Lazarus Group and TraderTraitor are essentially a state intelligence service using criminal methods for revenue, which the MSMT estimated that in 2024 equaled around a third of North Korea’s foreign currency earnings. This is not only a transnational crime problem, but also a state threat with the MSMT commenting that “Under North Korean leader Kim Jong Un, the DPRK cyber force has expanded into a full-scope, national program operating at a sophistication approaching the cyber programs of those in China and Russia.”The US Government has documented institutional links between North Korean hacking groups and its military intelligence apparatus. In September 2019, the US Treasury Department sanctioned hacking groups Lazarus, Bluenoroff, and Andariel, stating that they are entities controlled by the North Korean Government. The Lazarus Group targets government, military, financial, manufacturing, publishing, media, entertainment, and international shipping companies, as well as critical infrastructure, using tactics such as cyber espionage, data theft, monetary heists, and destructive malware operations. The US Treasury stated that the Lazarus Group was created by the North Korean Government around 2007 and “is subordinate to the 110th Research Center, 3rd Bureau of the RGB.” The Reconnaissance General Bureau is North Korea’s primary military intelligence organisation, responsible for foreign intelligence, clandestine operations and cyber activities, and is also the principal North Korean intelligence agency involved in the trade of North Korean arms (US Treasury, 13 September 2019).Based on the information from crypto research firms, law enforcement agencies in Japan and the US, and international agencies such as the Multilateral Sanctions Monitoring Team, there is well developed body of evidence showing that the North Korean Government uses its military intelligence agency for hacking operations and related criminal enterprises, including huge frauds and thefts. If the links from the Binance theft to North Korea are confirmed, the scale of North Korean criminality has increased to proportions that pose a threat to financial systems around the world. This is a state threat.Chinese Underground BankingAfter stealing such substantial amounts in cryptocurrency, the North Korean groups need to find a way to convert the tokens into fiat currency and avoid detection. According to the Multilateral Sanctions Monitoring Team, “The DPRK heavily relies on Chinese banks to access China’s formal financial system to cash out stolen cryptocurrency.” In addition to the established banking system, Chinese underground banking is a key channel to convert cryptocurrency into cash. The MSMT has listed multiple examples of Chinese financial intermediaries assisting North Korean cybercrime groups converting cryptocurrency to fiat currency, including Chinese nationals and companies in Shenzhen and Hong Kong.In 2020, the US Department of Justice charged two Chinese nationals with laundering over $100 million in cryptocurrency derived from hacks of a cryptocurrency exchange connected to the Lazarus Group. Tian Yinyin and Li Jiadong received the stolen funds from a hack in April 2018, and transferred the currency among addresses they held to disguise the origin of the funds. This included the transfer of nearly $1.4 million worth of Bitcoin into prepaid Apple iTunes gift cards, which at certain exchanges can be used for the purchase of additional Bitcoin (US Treasury Department, 2 March 2020).In 2023, two Chinese nationals, one based in Hong Kong and another in Mainland China, were identified by the US authorities as assisting the Lazarus Group to convert crypto into fiat currency. The two men, Wu Huihui and Cheng Hung Man, were directed by a representative of the North Korean ‘Korea Kwangson Banking Corporation’ based in Dandong to pay front companies for goods such as tobacco and communications equipment using funds derived from stolen cryptocurrency (US Treasury Department, 24 April 2023).In 2024, two Chinese nationals based in the United Arab Emirates (UAE) were sanctioned when US authorities alleged that they worked through a UAE-based front company to facilitate money laundering and cryptocurrency conversion services for North Korea. This operation was also connected to a representative of the North Korean Korea Kwangson Banking Corporation who was responsible for money laundering (US Treasury Department, 17 December 2024).In addition, the Chinese language “guarantee marketplaces” such as Xinbi, Tudou and Huione that have emerged in little more than five years to become the digital backbone of Chinese organised crime in Asia have facilitated laundering of billions of proceeds of financial crime believed to have come from North Korean cybercrime groups (Asian Crime Century briefing 176).In 2025, the US Treasury’s Financial Crimes Enforcement Network (FinCEN) stated that from August 2021 to January 2025, Huione had laundered at least US$4 billion in illicit proceeds, including funds from Southeast Asian online fraud and also cyber thefts conducted by the Lazarus Group (US FinCEN, 16 October 2025). In 2026, the US Treasury Department stated that the Xinbi Guarantee platform has reportedly been used by North Korean hackers as well as major Chinese organised crime groups such as the Prince Group (US Treasury Department, 9 September 2026).Cases involving Chinese money launderers working with cybercrime groups that are part of the North Korean military intelligence apparatus date back almost a decade. The synergy between Chinese underground banking and North Korean cybercrime is now well established.* * *The $6.3 billion Binance theft illustrates how North Korea has transformed cybercrime into a state threat, exploiting sophisticated hacking capabilities to generate enormous illicit revenue. The success of these operations depends on their ability to steal cryptocurrency and also on the involvement of Chinese underground bankers, cryptocurrency brokers and criminal financial marketplaces. The cases documented over almost a decade illustrate the increasingly close relationship between North Korean state-sponsored cybercrime and Chinese organised crime. This is a convergence of state intelligence operations and transnational organised crime that is an immediate threat to the cryptocurrency industry, but is also exposing huge risks to the international financial system as the use of crypto increases. Organised crime groups and networks can be essential enablers of hostile state activity, which can be directed at our financial system by those states with hostile intent. The Binance theft case is a wake-up call to this threat.[1] Note: The Multilateral Sanctions Monitoring Team (MSMT) is a multilateral mechanism to monitor and report violations and evasions of sanction measures stipulated in the relevant United Nations Security Council resolutions (UNSCRs). MSMT Participating States include Australia, Canada, France, Germany, Italy, Japan, the Netherlands, New Zealand, the Republic of Korea (ROK), the United Kingdom, and the United States.
Click Here For The Original Source.
——————————————————–
