Photo: Pyongyang Railway Station platform, Pyongyang, North Korea (DPRK).jpg · Ptrump16 · CC BY-SA 4.0 · cropped (file photo)
At 20:05 UTC on October 29, 2026, a compromised laptop of a Binance DevOps engineer gave North Korean hackers entry into a critical service container. Within 20 minutes, the regime siphoned $6.3 billion to directly finance its illicit nuclear weapons program.
How a compromised laptop yielded $6.3 billion in 20 minutes
On October 29, 2026, hackers identified as TraderTraitor accessed a Binance service container through an engineer's compromised laptop. The hackers used pre-signed authorizations and EIP-7702 delegation on Ethereum to turn a Binance hot wallet into a sweeper they controlled.
In just 20 minutes, stolen funds moved across ten blockchains into mixing services like Tornado Cash to obscure transaction origins. Binance and crypto partners quickly froze roughly $3 billion, while stablecoin issuers like Tether and Circle locked down another $2.67 billion.
| Exchange / Target | Amount Stolen | Year |
|---|---|---|
| Binance | $6.3 billion | 2026 |
| Bybit | $1.5 billion | 2025 |
| Ronin Network | $620 million | 2022 |
| Upbit | $41 million | 2019 |
Is North Korea really using crypto to build nuclear weapons?
Yes, findings from international monitoring bodies confirm state cyber theft feeds illicit weapons procurement networks. UN reports indicate DPRK-attributed cyber proceeds finance weapons procurement networks while generating half of North Korea's foreign currency income. U.S. intelligence assesses the regime secures at least $1 billion annually through financial cybercrime for weapons development.
South Korea's National Intelligence Service reported that North Korea stole over 2 trillion won (approximately $1.4 billion) in 2025 alone. State operatives rely on tactics like deepfake-enabled disguised employment and remote smartphone wiping to evade law enforcement.
Why the Binance heist matters to crypto holders and national security
The massive theft dampens risk appetite across digital asset markets and prompts investors to reassess safety on centralized exchanges. In response to growing threats, U.S. Cyber Command is executing a proactive shift toward persistent engagement to disrupt North Korean operations.
Beyond commercial crypto security, billions in stolen funds directly strengthen weapons capabilities that threaten U.S. allies and international stability. Law enforcement agencies like the FBI and Secret Service must commit significant public resources to trace and seize these state-stolen assets.
What to watch next as international pressure mounts
Federal agencies are working alongside Binance and firms like TRM Labs, Chainalysis, and Elliptic to trace and recover unfrozen funds. The U.S. Treasury Department is expected to continue and potentially expand sanctions targeting entities facilitating North Korean crypto laundering.
South Korea and Japan are expanding joint countermeasure seminars and intelligence sharing to counter state-sponsored cybercrime. Meanwhile, the UN Panel of Experts will document evolving evasion tactics in upcoming Security Council reports.
FAQ
How much of the $6.3 billion stolen from Binance was frozen?
Binance, stablecoin issuers, and blockchain partners successfully froze roughly $5.67 billion across various tokens and networks.
Has South Korea recovered crypto stolen by North Korean hackers before?
South Korean police identified Lazarus in the 2019 Upbit hack and recovered 4.8 Bitcoin with help from Swiss authorities.
Sources
theguardian.comtheguardian.comcbsnews.comcbsnews.comboston25news.comboston25news.comwmbdradio.comwmbdradio.comjoongang.co.krjoongang.co.krResearched from public reporting (including Korean-language sources) and written with AI assistance. Check the original articles for details.
