A North Korean hacking group has been identified as the force behind the theft of $6 billion (~8 trillion won) in crypto assets from Binance, the world’s largest cryptocurrency exchange. In an official announcement on the 31st of last month (local time), the U.S. Federal Bureau of Investigation (FBI) attributed the incident to the North Korea-linked group “TraderTraitor.” The scale of the theft is the largest ever for a single crypto hacking incident, and the crime is said to have taken just over 20 minutes.
The incident occurred on the 29th of last month. In its statement, the FBI named TraderTraitor as the perpetrator of the malicious cyber activity and disclosed crypto wallet addresses it judged to be operated by or closely linked to the North Korean group. It did not, however, release the full body of specific investigative materials or the complete basis for linking each wallet to the North Korean group.
Blockchain analytics firms confirmed North Korea-linked indicators in both the fund flows and the attack methods. Chainalysis said it detected evidence that the stolen funds were mixed in the same wallets as funds taken in a past Bitget hack. This goes beyond a mere similarity in money-laundering methods: the two separate incidents are connected through actual fund flows. Elliptic also reported that the funds from the two incidents were combined after passing through multiple wallets, a link first discovered by blockchain-tracking expert ZachXBT and later confirmed by the firm’s own analysis.
Elliptic also cited the overlap in laundering services used in this incident and in the BigONE, WOO X and AFX hacks classified as the work of TraderTraitor. In other words, the same services were mobilized to conceal the origin of criminal proceeds.
The preparation and execution of the attack also repeated the methods of past North Korea-linked groups. According to TRM Labs, the attackers began preparations at least 36 hours before the crime. They withdrew small amounts from Tornado Cash, a service that makes it difficult to trace the origin of funds, moved them to attack wallets, and tested malicious code ahead of the actual attack. They also used a method of executing pre-obtained transaction approval signatures all at once. Approval signatures are a kind of electronic signature that permits the transfer or trading of a specific asset to another address.
Differences were also identified in the money-laundering methods, however. TRM Labs noted the use of large-scale crypto exchange and lending services in this incident. It explained that this differs from the Bybit incident of February last year (approximately $1.5 billion, ~2 trillion won in losses), where the standout method was moving assets across different blockchains. The FBI also named TraderTraitor as the force behind that incident at the time.
The scale and share of North Korea-linked hacking have expanded rapidly in recent years. According to data released by Chainalysis on the 1st, North Korea-linked incidents account for roughly 89% of all reported crypto hacking losses so far this year. That is nearly six times the 15% recorded in 2021.
Category2021As of 2026Estimated North Korea-linked share (of total losses)15%~89%Average loss per incident$50.65 million (~68 billion won)$185.65 million (~250 billion won)Cumulative losses, 2021–Oct. 29, 2026—$13.24 billion (~17.7 trillion won)
Note: Cumulative losses account for about 59% of total crypto hacking losses over the same period.
The average loss per incident grew about 3.7-fold over the same period, from $50.65 million to $185.65 million. Cumulative losses from 2021 through Oct. 29 of this year were tallied at $13.24 billion. Kwon Jun-hyuk, head of Chainalysis Korea, said, “North Korea-linked crypto hacking continues to expand in scale and has established itself as a major security threat across the industry,” adding, “The on-chain link confirmed in this Binance incident shows that blockchain analysis plays an important role in identifying the forces behind an attack and tracing stolen funds.”
This incident is drawing attention because the nature of the attack itself has changed. In the past, the dominant approach was to breach a company’s core computer networks head-on, but recently the pattern of targeting peripheral connection points has become more prominent. A report published by AhnLab on the 29th of last month, analyzing hacking incidents in South Korea and Japan over the past month, said that entry points cited included employee sales-support systems, external mutual-aid websites, external backup services, portals and temporary files left in the cloud. The report noted that autonomous attack agents, rather than breaching highly fortified core systems head-on, automatically scan the entire broad external attack surface and persistently probe weak links on the periphery where security controls are relatively loose.
Chain infiltration that targets third-party vendors serving multiple clients is another new feature. In a report on the 21st of last month, Microsoft (MS) disclosed a case in which a China-linked hacking group accessed a multi-tenant app of an external IT vendor and then used the permissions already granted to the app to attempt intrusions into client companies’ clouds. The attack mobilized ARTEX, an AI tool that had been used to penetrate South Korea’s financial sector. Among the cases MS analyzed was one in which it took less than three hours from selecting a target to obtaining cloud administrative privileges. This means that even without attacking each client individually, breaching a single cloud service shared by multiple companies can spread damage across all of them.
AI is acting as a catalyst that raises both the speed and the scope of attacks. Kim Beom-su, a professor at Yonsei University’s Graduate School of Information, noted, “AI can find in bulk vulnerabilities that were not targeted in the past because they were considered unimportant or unlikely to yield a successful hack,” adding, “Finding and linking multiple vulnerabilities can lead to yet another powerful attack.”
Defenders are also using AI, but the time required to deploy it in the field is a bottleneck. Choi Dae-sun, a professor in Soongsil University’s School of Software (head of the AI Safety Research Center), said, “An attack only needs to find one technique that works on a single flaw, but defense requires access control, authentication, detection and patching to work together,” adding, “Even with the technology, defense takes time to be applied in the field.” Professor Kim argued, “In an environment where humans and AI attack together, systems that were safe in the past cannot be assumed to remain safe,” adding, “Rather than trying to reduce incidents to zero, the goal should be to prioritize the defense of critical and important systems to reduce the resulting damage.”
Gaps in the threat intelligence sharing system have also come under scrutiny. According to South Korea’s Financial Services Commission, which investigated last month’s financial-sector hacking incident, information identified by the Financial Supervisory Service and the Financial Security Institute was disseminated to financial companies through the integrated control system, but information each company obtained through its own security monitoring was not shared with other companies. This meant it was difficult for one company to learn in advance about suspicious access or new attack methods discovered by another. As attackers can change IP addresses or intrusion routes and try again, there are calls for a system to quickly share information obtained by individual companies and respond jointly.
This incident has once again exposed the structural vulnerabilities of the crypto market. The fact that 8 trillion won drained from a single exchange in 20 minutes shows that centralized exchanges’ custody and approval systems cannot control large-scale fund movements in real time. As the laundering route of stolen funds through Tornado Cash and exchange and lending services has been confirmed, questions are also being raised about the effectiveness of on-chain tracking and cooperation among exchanges to freeze funds. With North Korea-linked hacking so concentrated that it accounts for 89% of total losses, pressure on regulators in various countries to designate sanctions targets and on exchanges to strengthen anti-money-laundering (AML) obligations is expected to intensify further. Voices in the security industry are calling for a re-examination of cloud and outsourcing structures that rely heavily on external services and for the swift establishment of always-on detection systems to counter AI-driven automated attacks.
Click Here For The Original Source.
——————————————————–
