r/technology and r/cybersecurity react to TRM Labs attributing the record $6.36 billion Binance theft to North Korea
TRM's minute-by-minute reconstruction shows how an attacker emptied hot wallets on ten blockchains in about 20 minutes.
The threads link a TRM Labs report on the theft of about $6.36 billion from Binance wallets on ten blockchains, most of it in roughly 20 minutes starting at 20:05 UTC on October 29. TRM calls it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of 2025, and attributes it with high confidence to TraderTraitor, which it describes as North Korea's premier hacking unit. TRM says the attacker likely gained the ability to make Binance's hot-wallet signing system sign arbitrary transactions; on Ethereum it used pre-signed EIP-7702 authorizations to take over a wallet. Binance had not published a root cause. As of TRM's snapshot, about $2.7 billion had been frozen, led by Tether and Circle.
About 34,000 upvotes in r/technology and 1,200 in r/cybersecurity. Top replies point out that an industry built on avoiding regulation ends up wanting governments to step in, question keeping crypto on an exchange at all, and ask who actually bears the loss.
-
Lazarus Group
After exploring North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History | TRM Labs, the group TRM blames has a long record, covered in Lazarus Group.
Wikipedia describes the Lazarus Group, also known as TraderTraitor, as a hacker group allegedly run by North Korea's government, to which researchers have attributed many cyberattacks.
Wikipedia · Swim · 30 min
0