GoKawiil
Tech News
Binance, the world's largest cryptocurrency exchange, was reportedly the target of a $6.3 billion theft attributed to a North Korean hacking group. The breach, disclosed Friday, triggered declines in bitcoin and other major tokens as crypto markets reacted to the news.
On October 29, attackers siphoned roughly $6.3 billion in cryptocurrency from Binance wallets spanning at least ten blockchains, with most funds taken within a 20-minute window, according to tracing firm TRM Labs. Binance suspended deposits and withdrawals and says it has helped freeze about half the stolen crypto while investigating the breach.
On October 29, 2026, an attacker drained roughly $6.36 billion from Binance wallets across ten blockchains, with most funds moved in about 20 minutes starting at 20:05 UTC. Binance confirmed a security incident and suspended withdrawals on several networks, while blockchain analysis firm TRM Labs says it has high confidence the theft was carried out by North Korea's TraderTraitor hacking unit. Issuers including Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum's Security Council froze roughly $30 million more, but the attacker still holds over $2.4 billion in ETH and BTC beyond recovery.
Dark Reading editors recapped federal action against North Korean-linked IT worker schemes, including a Texas-based operation where laptops were used to disguise overseas workers as US-based employees. The segment also touched on unrelated retail news involving a Staples gift card promotion.
The FBI conducted searches at more than 40 residences across Texas and filed charges against American facilitators accused of helping North Korean workers secure remote US jobs using stolen or fabricated identities. Investigators say the scheme funneled millions of dollars in wages back to North Korea, with the Americans allegedly running 'laptop farms' to make it appear the workers were logging in from US locations.
The Department of Justice disrupted operations tied to Famous Chollima, a North Korean threat group, arresting two suspects and charging 14 individuals. The FBI's 'Lonestar Roundup' operation searched 40 Texas residences between September 21-25, seizing about 187 laptops and KVM devices used to run so-called laptop farms that let North Korean IT workers appear to be based in the US.
The FBI, working with CrowdStrike, shut down more than 40 laptop farm operations in Texas used to run fake remote-worker schemes, seizing over 200 devices. No arrests were made immediately, as authorities moved to disrupt the operations quickly rather than wait for formal charges, though they warned participants of possible future criminal penalties.
The Department of Justice says it has indicted and arrested two Americans and seized over 180 computers from more than 40 laptop farms across Texas, which North Korean operatives allegedly used to remotely access jobs at U.S. companies under stolen identities. Prosecutors say at least 70 companies across 17 states and DC—spanning healthcare, retail, manufacturing and other sectors—were infiltrated, generating roughly $3 million in illicit proceeds.
Security researchers from Genians, Proofpoint, Digital Security Lab Ukraine and Enki White Hat report that North Korean state-linked hacking groups, including one tracked as TA406 (also known as Konni or Opal Sleet), have been spear-phishing Ukrainian government, policy and academic targets since at least February 2025. The campaign aims to gather intelligence on Ukraine's wartime position after North Korea began sending 14,000 to 15,000 troops to support Russia in October 2024.
Blockchain data platform Chainalysis found that attacks using 'Blockchain Dead Drops' — a technique storing malware payloads or command-and-control configuration data on public blockchains — grew more than fivefold over the past year. The report attributes much of the increase to North Korean and Iranian state-linked actors and Russian-speaking criminal groups, and notes a 440% rise tied to wider availability of Chinese open-source AI tools.
Bitget CEO Gracy Chen said a September 24 breach that drained $387.5 million from the exchange showed signs of North Korean state-sponsored hackers, pointing to VPN infrastructure previously linked to such groups. Attackers exploited a backend wallet system, forging transfer approvals to authorize fraudulent withdrawals, while cold wallets and private keys stayed secure. Bitget froze withdrawals temporarily and said its $464 million User Protection Fund would cover the entire loss.
Crypto exchange Bitget disclosed a $388 million security breach and said it is 'very likely' the work of North Korean hackers. The company stated that user private keys were not compromised and that a bitcoin-backed protection fund will cover the losses, while withdrawals remain frozen pending an investigation.