Photo via BBC News

Why North Korea's 'elite' hackers are the prime suspect in major Binance hack

Read the original at BBC News ↗
Cite

Jamali, L. (2026, October 31). Why North Korea's 'elite' hackers are the prime suspect in major Binance hack. BBC News. https://www.bbc.co.uk/news/articles/ck9dz3v7z7v3o?at_medium=RSS&at_campaign=rss

Dated from the outlet's own feed. Check the original for its byline.

BBC News · collected 2026-10-31 · by Lily Jamali

Quick Summary

Two major blockchain analytics firms, TRM Labs and Chainalysis, identify the Lazarus Group, a state-backed North Korean hacking unit also known as TraderTraitor, as the likely perpetrators behind the $6.3 billion hack on Binance, the world's largest cryptocurrency exchange. The article highlights how North Korea, one of the world’s poorest nations with restricted internet access, relies heavily on cybercrime for financial gain, targeting exchanges like Bybit and now Binance. Despite Binance initially stating that an engineer's laptop was compromised, they later acknowledged a broader breach affecting their hot wallet system.
Written by AI on 2026-10-31, from this article's own text only (the story summary below draws on all the coverage).

AI analysis

Story summary

On October 29, Binance, the world's largest cryptocurrency exchange, reported a potential security issue that led to massive transfers of funds, prompting concerns of a hack. Stablecoin issuers Tether and Circle froze over $1.5 billion in assets related to this incident by October 30. By late October 30, Binance stated at least $2.54 billion in crypto funds had been frozen as the company suspended all deposits and withdrawals to investigate further. On October 31, Binance confirmed a significant security breach resulting in an estimated loss of up to $6.3 billion, making it potentially the largest cryptocurrency theft ever recorded. This event has raised broader concerns about the safety and risks involved with digital assets, impacting investor confidence significantly. Experts from blockchain analysis firms like TRM Labs and Chainalysis suspect North Korea’s state-backed hacking group, the Lazarus Group, to be responsible for this major heist.

Written for “Binance Hack Linked to North Korea” on 2026-10-31, grounded in this article and the 37 other(s) covering the same event.
Why this leaning score
This article does not take a side on a contested political question, so it has no leaning score. That is an answer rather than a gap: a match report or a rescue can be warmly or critically written without being left or right, and scoring it anyway is how approval of a subject gets recorded as a political position.
No political leaning scored for article 118922 · logged 2026-10-31

Story

📰 Binance Hack Linked to North Korea
Technology · 38 article(s) covering the same event. Compare every outlet's account →

Compared with similar articles

This article reads unscored and hedges 9% of its claims. Each row says how that neighbour differs.
The Guardian
Hedges 2 of 30 claims Outlet record 66/100
The Sydney Morning Herald
Hedges 7 of 28 claims Outlet record 61/100
BBC News
Hedges 0 of 5 claims Outlet record 68/100
Toronto Star
Hedges 0 of 24 claims Outlet record 64/100
CBC News
Hedges 2 of 27 claims Outlet record 60/100
New York Post
Hedges 1 of 13 claims Outlet record 66/100
BBC News
Hedges 7 of 39 claims Outlet record 68/100
NPR
Hedges 1 of 26 claims Outlet record 60/100
Al Jazeera
Hedges 5 of 41 claims Outlet record 60/100
BBC News
Hedges 2 of 23 claims Outlet record 68/100
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
23
sentences that state something as happening or true
Uncertain
9%
2 of 23 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
68/100
BBC News's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
38
Technology
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-10-31 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

BBC News · 4736 article(s) · 6 correction(s) detected
Running correction rate · 6 correction(s)

Who wrote this

Lily Jamali
8 article(s) here · 0 carrying a prediction
🔮 In May, Meta was among the social companies that avoided a trial by settling a case brought by a Kentucky school district that claimed their product design had led to a youth mental health crisis.
🔮 - Published TikTok and its parent company ByteDance will pay the US state of Alabama $100m (£754.5m) and make a series of changes to restrict usage by children in the state as part of a lawsuit settlement.
🔮 - Published OpenAI said Friday it had alerted "dozens" of global institutions that their websites may have been impacted by its AI agents acting improperly.
🔮 - Published The boss of Snapchat-parent Snap Inc says the firm would be "willing to implement" time limits for teens, following a call from Meta for it to take action.
🔮 An AI researcher who left Anthropic told the BBC that "if we don't slow down at the current rate of progress, there is a strong chance that we could all die in the immediate future".
🔮 Coxon, a 27-year-old who worked at OpenAI before joining its chief rival Anthropic, said on Tuesday that people building artificial intelligence (AI) believed the technology could destroy humanity.
🔮 Ben Wood, chief analyst at technology research firm FDM CCS Insight, said it was likely Ternus's promotion was timed specifically "to coincide with what will be arguably one of the biggest iPhone launches for many years".
Also by Lily Jamali
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 8 articles by Lily Jamali →

Topics

Binance FBI North Korea North Korean TraderTraitor

Subjects

Binance ORG · 7× North Korean NORP · 6× Chainalysis ORG · 2× FBI ORG · 2× North Korea GPE · 2× TraderTraitor ORG · 2× Kim Jong Un PERSON · 1× Pyongyang GPE · 1× TRM Labs ORG · 1× The Lazarus Group ORG · 1×

Narrative

Much of its hacking activity has centred on monetary gain. North Korean hackers are also suspected in the theft of $620m worth of cryptocurrency in 2022. In this most recent heist, North Korean agents are accused of using a special authorisation to turn a Binance hot wallet, which is connected to the internet, into one that moved funds automatically to the attacker.
framing: assertive · carried by 1 article(s) · first seen 2026-10-31

Claims (23 extracted, 2 hedged)

- Published Two major blockchain analytics firms say they have robust intelligence pointing to a North Korean state-backed group as the likely culprits in the $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange. asserted
they → publish → Binance
The Lazarus Group, a North Korean hacking unit also known as TraderTraitor, was identified "with high confidence" by TRM Labs, as well as Chainalysis. asserted
Group → know → Labs
This incident is just the latest linked to the country, one of the poorest in the world and where access to the internet is severely restricted. asserted
access → link → internet
Experts accuse the government of North Korean leader Kim Jong Un of relying on cybercrime to finance itself, something Pyongyang has long denied. asserted
Pyongyang → accuse → something
Though not financial, the nation's most spectacular suspected hack took place in 2014. asserted
hack → suspect → 2014
The target: Sony Pictures, which had made the Hollywood film The Interview. asserted
which → make → film
The film involves a plot to assassinate Kim. asserted
film → involve → Kim
The resulting hack exposed thousands of embarrassing emails exchanged among the studio's top executives. asserted
hack → result → executives
Last year, the Federal Bureau of Investigation (FBI) said North Korea was responsible for the theft of $1.5bn on the Bybit exchange. asserted
Korea → say → exchange
In the aftermath of that incident, the agency said TraderTraitor had moved to quickly launder and disperse the stolen assets, converting them to Bitcoin and other digital assets with a goal of eventually turning them into hard currency. asserted
TraderTraitor → say → currency
The FBI has broadly accused North Korea of "illicit cybercrime and virtual asset theft activities". asserted
FBI → accuse → cybercrime
The nation has systematically developed its cyber operations, recruiting the most promising students from universities and channeling them into hacker groups overseen by North Korea's intelligence agency, according to reports. uncertain
nation → develop → reports
Some of the cyberwarfare conducted takes place just over the nation's border in China, according to analysis from tech groups. uncertain
Some → conduct → groups
Much of its hacking activity has centred on monetary gain. North Korean hackers are also suspected in the theft of $620m worth of cryptocurrency in 2022. In this most recent heist, North Korean agents are accused of using a special authorisation to turn a Binance hot wallet, which is connected to the internet, into one that moved funds automatically to the attacker. asserted
that → centre → attacker
TRM said it's likely the attacker gained access to Binance's hot wallet signing system as part of the scheme. asserted
attacker → say → scheme
Binance has not directly responded to the BBC's queries about the incident's potential links to the area. asserted
Binance → respond → area
The company had initially said it thought an engineer's laptop had been compromised, allowing unauthorised withdrawals, but later said the attack was wider. asserted
attack → say → withdrawals
"Our subsequent investigation has uncovered additional points of breach," Binance's co-CEO Richard Teng said. asserted
Teng → uncover → breach
Some 80% of stolen assets have been secured, a Binance spokesperson said on Friday, but the rest remains unaccounted for. asserted
rest → steal → Friday
If the accusations are true, the record-making heist shows how powerful suspected North Korean hackers have become – a sign that the tools of the hacking trade have grown sharper. asserted
tools → show → trade
Experts say the rise of artificial intelligence has also given threat actors new ways to carry out crime, through automation and other means. asserted
rise → say → automation
In this case, it's plausible that AI was used to infiltrate Binance's systems. asserted
AI → use → systems
As Chainalysis put it, the attacker used laundering patterns "we have not seen before". asserted
we → put → patterns
💬Give feedback
🕘History 🎫Support