North Korea Steals USD 6.36B from Binance in the Largest Hack in History
Comments on “North Korea Steals USD 6.36B from Binance in the Largest Hack in History”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
An attacker drained about $6.36 billion from Binance wallets on ten blockchains on October 29. TRM Labs attributes it with high confidence to North Korea's TraderTraitor. Issuers and Arbitrum froze roughly $2.7 billion, but about $2.4 billion in ETH and BTC is out of reach. Binance's preliminary account cites a compromised DevOps laptop; TRM infers compromised signing infrastructure. Figures come mainly from TRM and Binance and are unverified. Builders should alert on unexpected EIP-7702 delegations and separate signing paths by chain.
Why it ranked
No. 2 of 111 with a score of 0.77. The panel rated it highest on new information (0.93) and significance (0.91), lowest on practical relevance (0.71). Placed No. 2, No. 3 by score alone: the placement terms moved other stories past it.
- AI judgeJudge 2claude-haiku-5-5
- Major security incident with strong onchain evidence and technical detail on EIP-7702 abuse and signing compromise; largely new relative to recent stories, though it is a crypto-industry event with narrower builder relevance in parts.
- AI judgeJudge 3gpt-5.6-luna
- A highly consequential, technically detailed crypto security incident with extensive on-chain evidence and actionable signing-infrastructure guidance. Attribution to North Korea remains an assessment rather than independently proven fact.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.77total under rubric v2.3
- Significance0.91
- Reader interest0.89
- Audience breadth0.73
- Practical relevance0.71
- Substantiated0.76
- Technical depth0.86
- New information0.93
- Counts against: Promotional0.11
- Counts against: Overclaim0.36
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.81 | 0.95 | 0.98 | 0.91 | 0.17 | +0.24 | +0.219 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.74 | 0.95 | 0.97 | 0.89 | 0.23 | +0.26 | +0.231 |
| Audience breadthHow many people who build technology does it concern? | 0.64 | 0.85 | 0.70 | 0.73 | 0.21 | +0.13 | +0.095 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.64 | 0.70 | 0.80 | 0.71 | 0.16 | +0.22 | +0.157 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.57 | 0.80 | 0.90 | 0.76 | 0.33 | +0.05 | +0.038 |
| Technical depthHow technically substantive is it? | 0.89 | 0.80 | 0.88 | 0.86 | 0.09 | +0.05 | +0.043 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.91 | 0.90 | 0.99 | 0.93 | 0.09 | +0.05 | +0.047 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.08 | 0.05 | 0.20 | 0.11 | 0.15 | −0.19 | −0.021 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.44 | 0.20 | 0.45 | 0.36 | 0.25 | −0.11 | −0.040 |
| Sum of contributions | +0.769 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.769 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-31/2/"><img src="https://rubric.hrih.si/badge/2026-10-31/2.svg" alt="Ranked #2 on Rubric, 31 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains.
The article gives no link or citation for it.
The article says “an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains”
The source says No source to compare with.
No source givenFirst, only or fastest
The Binance theft is the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025.
The article gives no link or citation for it.
The article says “That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025”
The source says No source to compare with.
No source givenCausal conclusion
TRM attributes the attack to TraderTraitor, North Korea's hacking unit, with high confidence.
The article gives no link or citation for it.
The article says “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence”
The source says No source to compare with.
No source givenQuote
The FBI named TraderTraitor as responsible for the USD 1.5 billion Bybit hack in February 2025.
The article gives no link or citation for it.
The article says “The FBI named the same group as responsible for the USD 1.5 billion Bybit hack in February 2025”
The source says No source to compare with.
No source givenCausal conclusion
The attacker used an EIP-7702 delegation with 50 pre-signed authorizations to turn a Binance Ethereum hot wallet into a sweeper it controlled.
The article gives no link or citation for it.
The article says “the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorizations prepared in advance”
The source says No source to compare with.
No source givenGeneralization
TRM assesses that the pattern across ten chains points to a compromise of Binance's hot wallet signing infrastructure.
The article gives no link or citation for it.
The article says “In TRM's assessment, this points to a compromise of Binance's hot wallet signing infrastructure”
The source says No source to compare with.
No source givenNumber
Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council froze roughly USD 2.7 billion in total.
The article gives no link or citation for it.
The article says “Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins”
The source says No source to compare with.
No source givenNumber
The attacker still holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach.
The article gives no link or citation for it.
The article says “It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach”
The source says No source to compare with.
Also covered by
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds
- Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets
- In the year AI re-wrote the infosec rulebook, it’s comforting to know crypto exchanges still have bad security
- Binance hot wallet signed 50 EIP-7702 delegations 3 minutes before the drain
- $6.3bn hacked from Binance in ‘largest’ crypto attack
- Binance says its $6.3bn hack involved more than a compromised laptop
Elsewhere
Elsewhere: HN 34 pts, not on front page
Recorded for context only, checked 31 Oct 2026, 05:46 UTC. It played no part in the ranking.