Record $6.3 Billion Binance Theft Is Tied to North Korea as a Fired General’s Leaks Come to Light

Economic Warfare & Trade Policy

Hackers stole $6.3 billion from the Binance cryptocurrency exchange on Thursday evening in what is likely the largest crypto theft on record, and two blockchain analysis firms quickly pointed at North Korea. Chainalysis said it had a “high degree of confidence that DPRK” was responsible, and TRM Labs attributed the theft to the North Korean group TraderTraitor, The Record reported. No government had publicly confirmed the attribution by Friday morning.

Key figures: $6.3B stolen from binance, per the exchange · $2.4B+ still held by the attackers after freezes · Nov. 1 CISA patch deadline for two flaws

Why it matters: if the attribution holds, it would be the largest crypto theft ever linked to North Korea, and it came in the same week that a spying tool aimed at satellite and defense networks surfaced and a fired US general admitted leaking classified information, showing how much of the current conflict is being fought over data.

How the Binance breach happened

Binance traced the breach to a DevOps engineer’s compromised laptop, but said the attack “was not a single ‘one-click’ action” and that it had not blamed any individual, BleepingComputer reported. Tether, Circle and other firms moved to freeze funds, yet the attackers still held more than $2.4 billion in Ethereum and Bitcoin. Binance said it would cover the losses, The Japan Times reported. Our Korean Peninsula story covers North Korea’s weapons display the same week, and our earlier report on the Wonsan launch has more on Pyongyang’s missiles.

The Binance case was not the only disruption. The Polymarket prediction market halted trading on October 29 after one of its third-party providers was compromised, and said affected traders would be reimbursed, The Record reported. In Russia, the home goods chain Poryadok said a cyberattack closed some stores and its online services for five days, according to The Record. No group has claimed it.

A tool built to steal keys

Cisco Talos said a newly identified group it tracks as UAT-11473 exploited a patched flaw in Cisco Catalyst SD-WAN controllers to install KeyDrift, a tool built to steal encryption keys, against space and satellite services, defense firms and policy research groups, BleepingComputer reported. Talos said the group appears to overlap with infrastructure used by China’s Volt Typhoon, but made no definitive link. Today’s space war story looks at the satellite angle.

The general who leaked

In Washington, Army Lt. Gen. Brett Sylvia, fired this week as the Joint Staff’s director of strategy, plans and policy, admitted leaking classified information about Iran and Ukraine to two reporters, according to an internal investigation report described by Axios, Iran International reported. Axios said he failed four polygraph tests, while another report citing a Pentagon official put the number at three, so the count remains disputed. Pentagon spokesperson Sean Parnell said the dismissal followed an extensive Air Force Office of Special Investigations inquiry. Today’s Iran war story covers what the leaks touched in the Middle East.

Iran’s newspapers debate a new war

The information battle also plays out in print. Iranian newspapers are openly debating whether another war with the United States is coming, Iran International reported. The economic daily Donya-ye Eghtesad said war was not inevitable, while a former diplomat writing in Shargh argued that Washington still had a diplomatic option.

Patch orders

On the defensive side, the Cybersecurity and Infrastructure Security Agency added two actively exploited flaws to its Known Exploited Vulnerabilities catalog on October 29: an integer overflow in GitLab that can let an unauthenticated user run code on the server, and a flaw in Cisco Secure Firewall ASA and FTD software. Federal civilian agencies must fix both by November 1. A separate Pentagon cyber case is in our report on the commissary freezer cyberattack probe.

Secretary of State Marco Rubio also signed a US-Hungary law enforcement and information exchange memorandum, saying the two governments are “aligned and taking steps together” to confront what he called a “resurgence of far-left terrorism,” according to the State Department.

By the numbers

At least 38% of the stolen $6.3 billion, or about $2.4 billion, was still in the attackers’ hands after the freezes, a TBR calculation from figures reported by The Record.

What comes next

Watch for any government confirmation of North Korean responsibility for the Binance theft, more freezes of stolen funds, new victims of the KeyDrift campaign, and any charges in the Sylvia leak case.

Sources

• The Record from Recorded Future News: Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds
• BleepingComputer: Binance links $6.3 billion crypto theft to compromised DevOps laptop
• The Japan Times: Hackers steal $6.3 billion from Binance in record heist blamed on North Korea
• The Record from Recorded Future News: Polymarket confirms cyberattack on third-party provider after outages
• The Record from Recorded Future News: Russian popular home goods chain faces days of disruption following cyberattack
• BleepingComputer: Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
• Iran International: Fired US general admitted leaking classified information on Iran
• The Times of Israel: Pentagon accuses fired general of leaking classified intel on Iran war to media
• Iran International: Iranian media debate new war amid Hormuz attacks, military buildup
• Cybersecurity and Infrastructure Security Agency: Known Exploited Vulnerabilities Catalog (entries CVE-2026-97229 and CVE-2026-76418, added Oct 29, 2026)
• US Department of State: Secretary Rubio and Hungarian FM Orbán at a MOU Signing Ceremony on Energy Infrastructure and Regional Energy Security and on Law Enforcement Cooperation and Information Exchange