As of 30 October 2026, the attribution question has an investigators' claim, not a court finding: TRM Labs traced the 29 October 2026 Binance breach to a North Korean unit called TraderTraitor. Other trackers have also pointed to North Korea. That distinction matters, because a tracing claim by investigators is not the same as a finding by a court, and readers should not treat it as legally proven.

Pyongyang has previously denied hacking allegations, and that denial is part of the record that should sit alongside the attribution claim. When a government denies past allegations, it does not by itself disprove a new tracing claim, but it does mean the claim remains contested at the level of public statements. No court ruling on this incident is included in the verified facts for this article.

The breach itself is estimated at about $6.3 billion, which would make it the largest crypto theft on record, surpassing Bybit's $1.5 billion in 2025. The scale is one reason attribution has attracted attention so quickly. Large thefts tend to draw specialist blockchain tracing firms, and their early findings often shape the first news cycle before any official legal process catches up.

What tracing can and cannot show is worth stating plainly. Blockchain analysis can follow the movement of funds across wallets and exchanges, and firms such as TRM Labs publish conclusions based on patterns they observe. Those conclusions are still assessments based on available data, and the investigation into this breach is ongoing. Figures and technical details remain preliminary estimates and may be revised.

The preliminary technical account does not by itself name an attacker. It says a compromised DevOps engineer's laptop may have let an attacker access a service container and submit unauthorised withdrawal transactions, with no evidence of a wallet private key leak found so far, on a preliminary basis. Separately, the attacker is reported to have used EIP-7702 on wallet Binance 14, turning it into a sweeper and moving about 204,500 ETH, leaving ETH backing near 94 percent from 100 percent on 1 October.

Attribution claims also sit alongside the practical response, which does not depend on who is named. About $3 billion has been frozen so far, including $2.3 billion in USDT and USDC. Tether froze more than $1.567 billion in USDT, Circle froze about $823 million in USDC, Ripple froze about $200 million, and World Liberty Financial froze $27 million in USD1. Freezes aim to stop funds moving further, whatever the identity of the attacker.

Binance co-CEO Yi He has said all losses will be covered from company funds and the SAFU emergency fund, which holds about $1 billion in bitcoin, and that user funds are safe. Deposits and withdrawals were suspended as a precaution, though some reports say deposits were unaffected, a discrepancy that should be noted. Yi He said she expects withdrawal resumption to begin within the next 48 hours.

Until more is confirmed, the honest summary is this: investigators claim a North Korean unit, TraderTraitor, is behind the attack, other trackers point in the same direction, and Pyongyang has previously denied hacking allegations. No court has ruled on this incident in the facts available here. Readers should rely on official Binance channels and further investigator updates, and treat early attribution as a claim to be tested, not a verdict.

FAQ: Who hacked Binance? TRM Labs traced it to North Korean unit TraderTraitor, and other trackers also pointed to North Korea, but this is an investigators' claim, not a court finding. Has North Korea responded? Pyongyang has previously denied hacking allegations. Is the attribution final? No, the investigation is ongoing and attribution claims may be revised as more evidence emerges.