Key Takeaways
- • Binance suffered a roughly 20-minute hack beginning 4 p.m. on October 29, 2026, drained of more than $6 billion across multiple blockchains, which CSIS describes as the largest crypto heist in history.
- • CSIS attributes the attack to North Korea's TraderTraitor group, a subset of Lazarus Group, noting it is the same actor behind the $1.5 billion Bybit theft in February 2025.
- • Binance froze about 44 percent of the stolen funds immediately; the remaining bitcoin and ether is described as effectively unrecoverable.
- • CSIS argues the attack was a monthslong operation using LinkedIn-based social engineering and malware, and that the funds fund North Korea's sanctions evasion and missile program.
- • CSIS contends U.S. policy is falling short, citing the Trump administration's reluctance to regulate crypto firms and an August 2026 presidential memo that bars private firms from targeting state-affiliated actors.
Summary
According to a CSIS analysis by Taylar Rajic and Nikita Shah, hackers began a 20-minute operation at 4 p.m. on October 29, 2026, that drained more than $6 billion from Binance, the world's largest crypto trading platform, across multiple blockchains. Binance froze around 44 percent of the stolen funds in the immediate aftermath, but the remainder, held in bitcoin and ether, is considered effectively impossible to recover.
CSIS attributes the attack to TraderTraitor, a North Korean hacking group, and notes it is the same actor responsible for the $1.5 billion Bybit theft in February 2025. The postmortem, as described by the authors, indicates a monthslong operation combining social engineering and technical intrusion. North Korean hackers targeted a Binance employee through LinkedIn, orchestrating fake interviews that led to the download of a malicious assignment, while a targeted ad campaign led a second employee to install malware. The authors say the evidence points to persistent access, rapid fund movement and destruction of evidence, though they judge that the majority of the operation relied on scripted automation rather than AI agents, despite reporting that an internal AI tool was an entry vector. TRM Labs measured most outbound cryptocurrency leaving Binance wallets within about 20 minutes.
CSIS places the attack within North Korea's broader strategy of regime survival, sanctions circumvention and defense funding. North Korea denied the FBI's attribution, and the sister of Kim Jong-un called it a "grave political provocation"; the authors cite on- and off-chain intelligence showing tactics consistent with prior TraderTraitor operations. Per the article, North Korean hackers have stolen approximately $12.8 billion in cryptocurrency since 2017, with about $7.8 billion from 2026 alone, and a 2024 UN panel found up to 40 percent of the defense budget was funded through stolen crypto. The laundering reportedly spanned 12,000 wallets, 11 blockchains and over 40,000 transactions, with funds often moved through Chinese banks that do not require real-name identification.
The authors argue U.S. policy has fallen short. They note the Trump administration's Scam Center Strike Force has helped prevent around $833 million reaching malicious actors, but say the administration's pro-innovation stance has made it reluctant to regulate crypto companies. They cite President Trump's October 2025 pardon of Binance founder Changpeng Zhao. Binance co-CEO Yi He said the company "should have invested more in security earlier," referencing a 2016 breach of 7,000 bitcoin (around $41 million) and noting 57 suspected North Korea-linked threat cases detected in 2026. CSIS also criticizes an August 2026 presidential memo authorizing private-sector offensive cyber operations, which it says forbids targeting state-affiliated actors. The authors conclude that the U.S. should set global standards, pursue stronger action against enabling nations, and hold exchanges accountable.
CSIS attributes the attack to TraderTraitor, a North Korean hacking group, and notes it is the same actor responsible for the $1.5 billion Bybit theft in February 2025. The postmortem, as described by the authors, indicates a monthslong operation combining social engineering and technical intrusion. North Korean hackers targeted a Binance employee through LinkedIn, orchestrating fake interviews that led to the download of a malicious assignment, while a targeted ad campaign led a second employee to install malware. The authors say the evidence points to persistent access, rapid fund movement and destruction of evidence, though they judge that the majority of the operation relied on scripted automation rather than AI agents, despite reporting that an internal AI tool was an entry vector. TRM Labs measured most outbound cryptocurrency leaving Binance wallets within about 20 minutes.
CSIS places the attack within North Korea's broader strategy of regime survival, sanctions circumvention and defense funding. North Korea denied the FBI's attribution, and the sister of Kim Jong-un called it a "grave political provocation"; the authors cite on- and off-chain intelligence showing tactics consistent with prior TraderTraitor operations. Per the article, North Korean hackers have stolen approximately $12.8 billion in cryptocurrency since 2017, with about $7.8 billion from 2026 alone, and a 2024 UN panel found up to 40 percent of the defense budget was funded through stolen crypto. The laundering reportedly spanned 12,000 wallets, 11 blockchains and over 40,000 transactions, with funds often moved through Chinese banks that do not require real-name identification.
The authors argue U.S. policy has fallen short. They note the Trump administration's Scam Center Strike Force has helped prevent around $833 million reaching malicious actors, but say the administration's pro-innovation stance has made it reluctant to regulate crypto companies. They cite President Trump's October 2025 pardon of Binance founder Changpeng Zhao. Binance co-CEO Yi He said the company "should have invested more in security earlier," referencing a 2016 breach of 7,000 bitcoin (around $41 million) and noting 57 suspected North Korea-linked threat cases detected in 2026. CSIS also criticizes an August 2026 presidential memo authorizing private-sector offensive cyber operations, which it says forbids targeting state-affiliated actors. The authors conclude that the U.S. should set global standards, pursue stronger action against enabling nations, and hold exchanges accountable.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.