VERDICT: FALSE — No evidence supports the claim that a Binance engineer’s romance with a North Korean spy caused the $6.3 billion hack. Binance’s co-CEO has denied it outright, and the investigator whose name was attached to the story never said it.
The claim
Within days of the largest cryptocurrency theft on record, a new explanation began racing around X. Posts claimed that a Binance DevOps engineer had been romantically involved with a North Korean spy, and had left a laptop unattended on the day of the attack — handing the attackers their way in. The story was dressed up with an authoritative-sounding attribution: it was supposedly the revelation of ZachXBT, a well-known independent blockchain investigator.
One version of the claim, posted by the account AlphaWire, passed 220,000 views, and a verified account repeated it on 1 November. A tale of romance, espionage and a careless laptop travels fast — and needs checking before it is believed.
The facts
First, the hack itself is real — but that is where the viral story’s accuracy ends. On or around 29 October 2026, attackers drained roughly $6.3 billion in digital assets from Binance’s hot wallets, across ten blockchains, in about twenty minutes. Binance says it will cover all customer losses, and about $3 billion was frozen with partners’ help. What is in dispute is how the attackers got in — and the romance story is not part of any credible account of it.
Second, ZachXBT did not say this. What the investigator actually published on 30 October was an on-chain analysis: funds stolen from Binance appeared to overlap with the trail of an earlier $388 million exploit of the Bitget exchange, suggesting the same actor was behind both. That earlier exploit had already been linked to TraderTraitor, the North Korean-linked hacking group. His findings say nothing about a Binance employee, a relationship, or a laptop left unattended.
Third, Binance’s own account contradicts the story’s key details. The exchange said its initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which may have given an attacker access to a service container used to submit unauthorised withdrawals. But it stressed that the attack was a complex, multi-stage operation, that it could not have been completed from a single machine, and that no individual engineer’s permissions alone could have moved the funds. Its investigation, it said, had not attributed responsibility to any individual. A “compromised” laptop is not the same as a laptop casually left unattended — and Binance has said how the laptop was compromised is still under investigation.
Fourth, the FBI’s attribution contains no romance either. On 31 October, the FBI, together with the US Secret Service and IRS Criminal Investigation, attributed the theft of more than $6 billion from Binance to North Korea’s TraderTraitor group, and published hundreds of wallet addresses it says hold or held the stolen funds. It describes the attackers converting the proceeds mainly into Ethereum and moving them through decentralised finance services. It says nothing about a relationship between an engineer and a spy, or an unattended laptop.
Finally, Binance’s leadership has denied the story directly. Co-CEO He Yi posted on X that the claim that “a Binance engineer’s romance with a North Korean spy led to the theft” is “more dramatic, but not true,” and that ZachXBT never said such a thing.
Verdict
FALSE. The $6.3 billion Binance hack was real, and a compromised engineer’s laptop may have been one entry point in a complex attack that US authorities attribute to North Korea’s TraderTraitor group. But the spy-romance explanation — a Binance engineer in a relationship with a North Korean agent who left a laptop unattended — is invented. It was falsely attributed to ZachXBT, it appears in neither Binance’s account nor the FBI’s, and Binance’s co-CEO has denied it in plain terms.
Why it matters
Stories like this do real damage in two directions. They smear an unnamed employee with an unproven accusation of betrayal, turning a victim of a sophisticated state-linked attack into a punchline. And they mislead the public about how such attacks actually work: replacing a technical investigation — compromised systems, multiple entry points, laundering trails — with a simple melodrama leaves readers less able to recognise the next genuine threat. A hack of this size deserves scrutiny of the facts, not of a fiction.
Related: Binance Suspends All Deposits and Withdrawals After Suspected Hack, Freezes $2.54 Billion | No, Saudi Arabia’s Defence Minister Did Not Kiss Iran’s President’s Hand — the Viral Photo Is Doctored
