Binance blocks 57 suspected North Korea-linked cyber threats in 2026

51Importance
no updates 6h+Status
4News media
Published
Updated

Binance said it blocked 57 suspected North Korea-linked cyber threats in 2026 and said it has replaced 98% of the tokens stolen in its earlier hack. North Korea rejected the FBI’s attribution of that breach to a state-linked hacking group, while US regulators contacted banks afterward about unusual activity.

Key claims & sources

✓
Binance said it blocked 57 suspected North Korea-linked cyber threats in 2026.
✓
Binance said it has replaced 98% of the tokens stolen in its $6.34 billion hack.
✓
North Korea rejected the FBI’s attribution of the Binance breach to a state-linked hacking group and called Washington’s allegations politically motivated.
✓
The FBI formally identified the North Korea-linked group TraderTraitor as the technical executor of the breach.
✓
Fed and OCC supervisors contacted US banks about unusual activity after the Binance hack linked to North Korea’s TraderTraitor unit.

What it means

TraderTraitor is the FBI's name for a North Korea-linked unit that investigators tie to the Lazarus Group lineage behind earlier crypto thefts, including the 2022 Ronin Network breach. Binance's own incident, now pegged at $6.34 billion in stolen assets, became the reference case for that attribution after the bureau named the group as the technical executor. Pyongyang has consistently denied responsibility for such hacks, as it did again through Kim Yo Jong.

Binance's disclosure that it blocked 57 suspected North Korea-linked threats in 2026 signals that the exchange now treats this as a standing operational risk, not a one-off breach. Replacing 98% of the stolen tokens restores most affected users' balances without waiting for recovery litigation, a cost Binance absorbs rather than passes on. Other exchanges face pressure to match that monitoring posture, while US banks contacted by the Fed and OCC must now document and report unusual activity tied to the same threat actor.

North Korea's rejection of the FBI's attribution, voiced by Kim Yo Jong as politically motivated, exposes how state-sponsored hacking allegations in crypto sit at the intersection of technical forensics and diplomacy. An exchange absorbing a $6.34 billion loss and quietly making users whole avoids a public reckoning over custody and security practices that a regulator-led process might have forced. That private resolution is convenient for Binance, but it leaves the attribution dispute, and the policy response to it, entirely in government hands.

Market reaction i

BNBBNB it is the asset of the company or protocol in the event

BNB fell 0.3% in the 4 hours after the first headline, after rising 0.2% in the 2 hours before.

$698.34 price at the headline
+0.2% 2 h before
-0.3% 4 h after
-1.6% 12 h after
First headline

48 prices, one every 30 minutes

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 3 15:45
+55 min
Nov 3 16:40
crypto.news adds
Adds $6.3B, with quotes
+1 h 35 m
Nov 3 17:20
Bitcoinist adds
Sharpens the figure: $6.3B
+9 h 11 m
Nov 4 00:56
Crypto Economy adds
Sharpens the figure: $6.4B, with quotes
+1 d 23 h
Nov 5 14:49
Crypto Briefing echo
No new facts: supervisors, regulators, contacted
+3 d 7 h
Nov 6 23:35
Crypto Briefing adds
Sharpens the figure: $6.4B; brings into the story: TRM

Thefts of a similar size

WhenWhat happenedFigure
5.9 years ago LuBian · Weak key generation incident $3.5B
5.6 years ago Thodex · Scam incident $2.5B
5.4 years ago Africrypt · Scam incident $2.3B
6.4 years ago Wirecard · Scam incident $2.1B
5.2 years ago BitConnect · Scam incident $2B

4285 incidents stored · 0 were as large as this one or larger ($6.4B)