# North Korean cryptocurrency exchange hacks > Developing situation record from CLSTR: https://clstr.news/situations/north-korean-cryptocurrency-exchange-hacks > Updated: 2026-10-29T05:05:26.000Z. Sources: 762. Developments: 2. Investigations into a massive theft from the Bybit exchange in February 2025 revealed sophisticated laundering networks used by North Korean hacking groups. The FBI attributed the theft of approximately $1.46 billion to $1.5 billion to North Korean actors known as TraderTraitor. Analysts found that stolen funds were moved across multiple blockchains using decentralized protocols, with over $1 billion laundered within four months through professional networks and Chinese intermediaries. Following this, Binance reported a much larger security breach with an estimated impact of $6.3 billion. Preliminary findings suggest the attacker gained access via a compromised laptop belonging to a DevOps engineer, potentially allowing unauthorized access to a service container to submit withdrawal transactions. Intelligence firms, including TRM Labs and Chainalysis, linked this attack to the same TraderTraitor operation. The breach involved coordinated transfers across 10 different blockchains, including Bitcoin, Ethereum, Tron, and Solana, reportedly beginning with a $296 million XRP drain after 36 hours of preparation. In response to the Binance breach, approximately $3 billion in affected assets were frozen on-chain. This included Tether freezing approximately $1.57 billion in USDT and Circle freezing over $800 million in USDC. Binance stated it would cover all losses using company funds and its Secure Asset Fund for Users, noting that they found no evidence that private keys were compromised. The company temporarily suspended all deposits and withdrawals during the investigation. ## Claims - Changpeng Zhao stated that user funds are safe. (reported by 48 sources) - Changpeng Zhao stated that the event looks like a hack on Binance. (reported by 22 sources) - Binance is actively investigating a potential security issue. (reported by 59 sources) - Tether froze more than $1.567 billion in USDT related to the potential hack. (reported by 36 sources) - Circle froze approximately $823 million in USDC. (reported by 36 sources) - Between $2.5 billion and $5.8 billion in cryptocurrency left Binance hot wallets. (reported by 30 sources) - Binance has temporarily suspended all deposits and withdrawals. (reported by 28 sources) - Hackers may have accessed the system via a compromised DevOps engineer's computer. (reported by 22 sources) - The cyberattack impact is estimated at approximately 6.3 billion dollars. (reported by 20 sources) - Approximately 3 billion dollars in stolen assets have been frozen. (reported by 19 sources) - The transaction initiating the outflow was funded through Tornado Cash. (reported by 17 sources) - The outflow included approximately 167,464 ETH from the Binance 14 wallet. (reported by 17 sources) ## Timeline ### 2026-10-29: Binance investigates massive $6.3 billion security breach Binance is investigating a record $6.3 billion security breach, potentially linked to North Korean hackers, after a DevOps engineer's laptop was compromised. 762 sources. https://clstr.news/cluster/binance-linked-wallets-see-277-billion-outflow ### 2026-10-08: Bybit theft exposes North Korean cryptocurrency laundering networks North Korean hackers, identified by the FBI as TraderTraitor, stole approximately $1.5 billion from Bybit in February 2025, utilizing complex cross-chain laundering networks to move funds. 4 sources. https://clstr.news/cluster/north-korea-uses-professional-networks-to-launder-stolen-cryptocurrency --- Cite as: North Korean cryptocurrency exchange hacks. CLSTR, https://clstr.news/situations/north-korean-cryptocurrency-exchange-hacks