Was North Korea really behind the Binance hack, or was it an inside job?
On October 29, approximately $6.4 billion was stolen from
@binance in the largest crypto hack in history.
Blockchain intelligence firms including
@trmlabs,
@chainalysis and
@elliptic have linked the attack to North Korea's TraderTraitor group.
But hundreds of users online, including
@cozypront,
@ylukem,
@Hannibal9972485,
@zectrillionaire and
@jords, are raising suspicions of a possible inside job.
We examined the arguments on both sides:
> Arguments for False: What challenges the North Korea attribution?
1. Attackers left billions in stolen funds exposed to freezes.
@elliptic found that the attackers were unusually slow to convert stolen stablecoins, allowing issuers to freeze more than $2.6 billion.
North Korean hackers typically convert such assets much faster. This unusual delay warrants scrutiny, although the unprecedented scale of the theft could explain the difference.
2. The attackers used a different laundering strategy from the North Korean Bybit hackers.
@trmlabs and
@elliptic observed that the Binance attackers relied heavily on large swaps through market makers and DeFi lending protocols. The North Korea-linked Bybit hackers, meanwhile, relied much more on cross-chain bridges and mixers.
3. Crypto accounts publicly questioned whether the hack was an inside job.
@CoinGapeMedia documented speculation from crypto commentators questioning how a compromised laptop could enable billions in unauthorized withdrawals.
@Cointelegraph also reported Binance's preliminary findings pointing to a compromised DevOps engineer's laptop.
However, compromised employee infrastructure is consistent with an external attack. No verified evidence currently establishes that Binance or its executives orchestrated the theft.
> Arguments for True: What links the attack to North Korea?
1. The attackers used preparation tactics matching earlier North Korean crypto thefts.
@trmlabs identified small Tornado Cash withdrawals, advance testing, and pre-signed authorizations executed in a coordinated burst. Similar tactics were observed in the 2025 Bybit hack, which the FBI attributed to North Korea's TraderTraitor group. The operational resemblance strengthens the attribution, although these techniques aren't exclusive to North Korean hackers.
2. Stolen Binance funds reached the same address as proceeds from another North Korea-linked hack.
@chainalysis identified stolen Binance funds mixing with proceeds from September's Bitget hack, previously attributed to North Korean actors.
@elliptic independently confirmed the shared destination.
This creates a direct on-chain connection between the incidents, although shared laundering infrastructure doesn't conclusively establish that the same attackers were responsible.
3. Multiple blockchain intelligence firms independently linked the theft to North Korea.
@trmlabs attributed the attack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence.
@chainalysis separately reached a similar conclusion through fund tracing, while
@elliptic also assessed North Korea-linked actors as responsible.
So what does the evidence tell us?
The strongest evidence currently points toward North Korea's TraderTraitor group.
The arguments against that attribution raise questions worth examining, but they don't carry equal evidentiary weight. And that's precisely why examining the underlying evidence matters.
On Verifact, we've brought together the arguments, evidence, and sources supporting both True and False, allowing traders to evaluate the claims themselves.