The US$6.3 Billion Theft – Binance, North Korean Cybercrime and Chinese Underground Banking - The Asian Crime Century
Crypto exchange Binance announced on October 30 that a security breach had led to unauthorized withdrawals totaling approximately $6.3 billion, with crypto research firm Elliptic calling it the largest theft of any kind in history.
On October 29, it took less than four hours for $6.3 billion to be stolen from Binance, with most of the cryptocurrency gone in just 20 minutes. Between 8:04pm and 11:56pm, the crypto was transferred via the Binance withdrawal system after a compromised engineer's laptop and "additional points of breach" allowed access to the company's systems.
While $2.7 billion was frozen by Tether, Circle, Arbitrum and four smaller issuers, $729 million was swapped into other cryptocurrencies, and $3.2 billion remains with wallets controlled by the culprits. To put the theft into perspective, Binance held $165.12 billion in reserves as of September, making this incident affect approximately 20% of their reported cryptocurrency holdings.
North Korean Cybercrime
On October 27, two days prior to the theft, Binance had reportedly announced blocking multiple North Korea-linked cyberattacks. TRM Labs has directly attributed the theft to TraderTraitor, a North Korean premier hacking operation, noting similarities to previous attacks including the Bybit hack in February 2025 that resulted in $1.5 billion in losses.
Features of the Binance theft are similar to earlier North Korea linked operations, including the Bybit hack and the KelpDAO hack in April 2026, including "small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst."
State-Sponsored Operations
The FBI, CISA, and U.S. Treasury Department have previously used the term "TraderTraitor" to describe a North Korean cybercrime campaign associated with the Lazarus Group and North Korea's Reconnaissance General Bureau. These operations are essentially a state intelligence service using criminal methods for revenue, which the Multilateral Sanctions Monitoring Team estimated equaled around a third of North Korea's foreign currency earnings in 2024.
In 2024 alone, North Korean cyber actors stole $1.19 billion in cryptocurrency from companies worldwide, with at least $1.65 billion stolen from January to September 2025. The MSMT found that North Korea launders stolen cryptocurrency before attempting to convert it into fiat currency used to fund its nuclear and ballistic missile programs.
Chinese Underground Banking
After stealing such substantial amounts, North Korean groups need to convert cryptocurrency into fiat currency while avoiding detection. The Multilateral Sanctions Monitoring Team reports that "The DPRK heavily relies on Chinese banks to access China's formal financial system to cash out stolen cryptocurrency." Chinese underground banking serves as a key channel for this conversion.
In 2020, the US Department of Justice charged two Chinese nationals with laundering over $100 million in cryptocurrency derived from hacks connected to the Lazarus Group. This pattern of using Chinese financial intermediaries to convert cryptocurrency to cash has been documented in multiple cases, with Chinese nationals and companies in Shenzhen and Hong Kong specifically mentioned.
If links from the Binance theft to North Korea are confirmed, the scale of North Korean criminality has increased to proportions that pose a threat to financial systems worldwide, representing not just a transnational crime problem but a state-level threat with global implications.
Related
