Was the Binance Hack North Korea? The Evidence and Two False Leads

What points to North Korea

The method. The attacker didn't steal funds through a code bug. He got a valid signature for Binance's own hot wallet. That's the same family of attack as Bybit in February 2025 ($1.4B, attributed to North Korea by the FBI) and Bitget in September 2026 ($387M, attributed to Lazarus by the FBI, Elliptic and Chainalysis, per ChainCatcher). In each case the signing process was the weak point.

The preparation. The setup wallets were funded through Tornado Cash. The attacker ran a dry run and then a full rehearsal on a dummy wallet four hours before the real drain. See the rehearsal.

The first hour. Anything freezable was swapped into ETH within minutes, using fresh splitter wallets and one wallet per token. That's the textbook Lazarus playbook from past hacks.

The context. Two days earlier, Binance said it had blocked a week of North Korea-linked fake job interview attacks aimed at its staff.

What doesn't fit, yet

EIP-7702 is new. Using an EIP-7702 delegation to take over an exchange hot wallet hasn't been seen at this scale in any attributed North Korean hack. See EIP-7702 explained.

The laundering hasn't started. After Bybit, Lazarus converted most of the stolen ETH to BTC through THORChain within days. Here, about 470,900 ETH and 17,270 BTC sit untouched. Nothing has gone to THORChain, Chainflip or eXch.

No wallet link. We checked the 30+ attacker wallets we've mapped. None has sent to or received from a known Lazarus address. We don't have the analytics firms' private address labels, so we can't rule a link out.

Other explanations remain open. An insider, or a compromised signing system without a state actor behind it, would also explain how a valid signature for Binance 14 was produced. Binance's first findings name a compromised DevOps engineer's laptop as the way in, but not who was behind it. It says it is working with law enforcement to identify the attackers.

False lead 1: "Same group as the Kelp DAO hacker"

The claim spread fast: the Binance attacker sent 74.56M ARB to an address that Arkham labels "Kelp DAO Hacker". Kelp DAO lost $293M in April 2026, an attack LayerZero attributed to Lazarus.

On Arbitrum, the story is different. The attacker did move the ARB to his own wallet 0x3E2b…32d5 at 21:36 UTC. But the second move, at 00:18 UTC, was a system transaction he never signed. The Arbitrum Security Council froze 74.56M ARB and 8,425 ETH (about $30.5M) and moved them to its freeze vault. That vault carries the Kelp label because Arbitrum froze Kelp's stolen funds there in April too.

The two hacks share a freezer, not a hacker.

False lead 2: "The hacker shorted ETH and BTC"

Lookonchain flagged Hyperliquid wallet 0x8added25f8cce417c1e19aad91fb6ddcb9917d2c. It shorted 22,047 ETH and 620.7 BTC around the hack and made about $3M. Some readers took it as the hacker profiting twice.

The on-chain record says otherwise:

• No transfers between it and any of the 30+ attacker wallets.
• A long history. The wallet is 271 days old with about 1,850 Ethereum transactions, mostly Aave and Pendle.
• Its own money. It funded the shorts by pulling 2.5M USDT from Aave and selling Pendle positions, then bridging.
• The timing. Its ETH short opened at 21:42 UTC, after CZ had already said publicly it looked like a hack.
• The Binance "link" is normal withdrawals from Binance hot wallets 17 hours earlier, the same thing every Binance customer has.

Lookonchain itself calls it a trader, not the hacker. That doesn't prove the two are unrelated, but nothing on-chain links them.

What would settle it

• An attribution from the FBI or a major analytics firm.
• The stolen ETH or BTC moving through THORChain, eXch or a known Lazarus laundering network.
• A transfer between these wallets and addresses from Bybit, Bitget or Kelp DAO.
• A slip by one of the setup wallets.

We watch for all of these hourly in the live timeline.