As of 30 October 2026, the short answer is that no court has decided who hacked Binance. The name most often cited in early reporting is TraderTraitor, described as a North Korean unit, after blockchain analysis firm TRM Labs traced the incident to that group. Other trackers have also pointed to North Korea, but those are investigators' claims, and they should not be read as a proven legal verdict.

The incident itself took place on 29 October 2026, when Binance, the world's largest crypto exchange, suffered a security breach with an estimated impact of about $6.3 billion. That figure, if confirmed, would make it the largest crypto theft on record, ahead of the $1.5 billion Bybit theft in 2025. All of these figures remain preliminary estimates while the investigation continues.

The preliminary investigation has pointed to a compromised laptop belonging to a DevOps engineer. According to that early account, an attacker used access from that laptop to reach a service container and submit unauthorised withdrawal transactions. This is a description of how access may have been gained, not a final finding, and investigators have not yet published a complete account of every step.

Importantly, the preliminary findings reported so far found no evidence of a wallet private key leak. That distinction matters because it changes the question investigators are asking: instead of focusing only on stolen keys, they are examining how a single compromised device and a service container could be used to authorise withdrawals at such a scale.

Attribution in crypto theft cases usually rests on tracing where stolen funds move and which tools and patterns appear familiar from earlier incidents. TRM Labs' tracing is one such effort, and the fact that other trackers reached a similar direction has strengthened the early reporting. Even so, tracing alone does not carry the same weight as evidence tested in court, and further detail may change the picture.

For its part, Pyongyang has previously denied hacking allegations. That denial does not settle the question either way, but it is part of the public record and a reason to keep the language careful: the TraderTraitor link is an investigators' claim, reported by trackers, rather than an established fact about who carried out the attack.

Binance co-CEO Yi He has said all losses will be covered from company funds and the SAFU emergency fund, and that user funds are safe. That statement addresses the financial impact on users, but it does not answer the attribution question, and it does not replace the work still to be done by investigators tracing the stolen assets.

What readers should watch for next is not a single headline but a sequence: further tracing results, any official statements from Binance, and any action by authorities if they bring a case. Until then, the honest summary is that TraderTraitor is the name investigators have put forward, North Korea is the country those trackers have pointed to, and neither has been established by a court. Figures in this article are preliminary estimates, and the investigation is ongoing. Readers should rely on official Binance channels for updates.

FAQ: Who do investigators say hacked Binance? TRM Labs traced it to TraderTraitor, a North Korean unit, and other trackers also pointed to North Korea. Has a court confirmed this? No, the attribution is an investigators' claim, not a court finding. Did the hack involve leaked wallet private keys? No evidence of a wallet private key leak has been found in the preliminary investigation.