Flash Report: Binance Crypto Theft Attributed to Lazarus Group

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 10:00 AM (EST) on November 3, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

• On October 29, 2026, threat actors reportedly stole USD 6.3 billion in digital assets from cryptocurrency exchange Binance. The attack is the largest cryptocurrency theft in history, surpassing the February 2025 Bybit heist.
• Binance originally reported the threat actors gained initial access via a compromised laptop belonging to a DevOps engineer. However, a further statement from Co-Chief Executive Officer (Co-CEO) Richard Teng suggested the attack was very likely more complex than initially believed and was almost certainly carried out by more than one person.
• On October 31, 2026, the Federal Bureau of Investigation (FBI) attributed the attack to North Korean threat actor TraderTraitor (an alias for Lazarus Group, which is also known as Jade Sleet and APT38).
• North Korea likely ordered the Binance attack in order to finance its government operations, including its nuclear program. The nation is largely ostracized from the international financial system, and crime (particularly cybercrime) is almost certainly its best covert source of income.

Details

On October 29, 2026, threat actors reportedly stole USD 6.3 billion in digital assets from cryptocurrency exchange Binance. The attack began around 20:05 UTC when five Binance-owned wallets on the XRP Ledger sent 233 XRP to a single, attacker-controlled cryptocurrency wallet address.¹

Binance is the world’s largest cryptocurrency exchange in terms of daily trade volume.²

XRP is a digital asset native to the XRP Ledger, an open-source, permissionless blockchain created in 2012 specifically for making payments with cryptocurrency.³

Following the initial transfer from Binance wallets, threat actors reportedly drained more Binance-owned hot wallets on the Solana, NEAR, Base, Optimism, Bitcoin, Tron, Ethereum, Arbitrum, and Avalanche blockchains. The largest losses were from Ethereum holdings—the second largest blockchain in the world—amounting to USD 3.8 billion across 186 different tokens.⁴ The entire theft very likely took less than half an hour from start to finish.

Binance originally reported the threat actors gained initial access via a compromised laptop belonging to a DevOps engineer and stated it had found no evidence of a private key leak.⁵ However, a further statement from Co-CEO Richard Teng suggested the attack was very likely more complex than initially believed and was almost certainly carried out by more than one person.⁶

The attackers reportedly used a self-destruct mechanism that wiped tooling and all traces as it ran and made the initial investigations more difficult. The attacker submitted a single transaction that was signed by the Binance private key and carried 50 authorizations.⁷ This almost certainly suggests a sophisticated operation that was very likely directed by a nation-state actor.

On October 31, 2026, the FBI attributed the attack to North Korean threat actor TraderTraitor (an alias for Lazarus Group, which is also known as Jade Sleet and APT38). The FBI stated it observed TraderTraitor converting assets stolen from Binance—primarily to Ether (ETH) coins;⁸ the threat actor group will almost certainly further launder the assets through decentralized finance (DeFi) platforms and instant swap services into higher security privacy coins.

TraderTraitor is a North Korean state-operated threat actor. Under its Lazarus Group moniker, the collective is likely most known as the party responsible for the 2014 attack against Sony Pictures.⁹ North Korea—especially Lazarus Group—is well-known for conducting attacks targeting cryptocurrency. The Binance attack was preceded in February 2025 by an almost certain North Korean theft of USD 1.46 billion in crypto assets from the Dubai-based Bybit exchange.¹⁰

North Korea likely ordered the Binance attack to finance its government operations, including its nuclear program. The nation is largely ostracized from the international financial system, and crime (particularly cybercrime) is almost certainly its best covert source of income. While Binance will very likely recover a significant amount of the stolen funds, North Korea will almost certainly gain a windfall profit from the operation.

1. hXXps://www.elliptic[.]co/insights/binance-largest-hack-in-history/ ↩︎
2. hXXps://www.binance[.]com/en-GB/about ↩︎
3. hXXps://xrpl[.]org/about/xrp ↩︎
4. hXXps://www.elliptic[.]co/insights/binance-largest-hack-in-history/ ↩︎
5. hXXps://www.bleepingcomputer[.]com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/ ↩︎
6. hXXps://www.elliptic[.]co/insights/binance-largest-hack-in-history/ ↩︎
7. Ibid. ↩︎
8. hXXps://www.bleepingcomputer[.]com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/ ↩︎
9. hXXps://www.bbc[.]co[.]uk/news/articles/ck9dz3v7z7v3o ↩︎
10. hXXps://www.elliptic[.]co/insights/bybit-hack-largest-in-history/ ↩︎