Crypto Theft: North Korea Linked to Record $6.3 Billion Binance Hack

Blockchain intelligence firm TRM states with high confidence that North Korea's elite hacking unit TraderTraitor is responsible for the theft of approximately $6.36 billion from Binance. The attack represents the largest cryptocurrency heist in recorded history. The firm noted that the attacker moved funds across ten different blockchains, completing the bulk of the transfer in roughly 20 minutes.

Binance, the world's largest cryptocurrency exchange, confirmed that it is working to freeze and recover assets. The company reported that it has frozen roughly $3 billion of the affected funds. As of Friday, Binance announced that it has begun the process of recovering assets for its users. The exchange stated that all user deposits were unaffected by the breach.

Withdrawals from the platform have been suspended and are expected to resume within the next one to two days. Binance pledged to cover all losses incurred by users during the incident. The company initially suggested the breach may have involved a compromised laptop, but a subsequent investigation identified additional points of entry into its systems.

Jonathan Levin, co-founder and CEO of Chainalysis, also attributed the hack to the North Korean group. In a post on X, Levin wrote that the attack was likely executed by the Democratic People's Republic of Korea group TraderTraitor. TRM pointed out that several features of this attack match previous North Korea-linked heists, including the $1.5 billion theft from the exchange Bybit in February 2025.

A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals. The spokesperson did not explicitly confirm the North Korean link in initial communications but emphasized the collaborative effort to bring the attackers to justice.

Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, raised questions about the security controls in place at the time of the breach. Gan suggested that a single signature granted the attacker a full-access token that never expired. This token allowed the attacker to access a Binance hot wallet, which holds user private keys and remains connected to the internet.

Binance stated on X that it found no evidence of any wallet private key leak. The company plans to release more technical details once its internal probe is complete. The incident follows a pattern of North Korea using cryptocurrency hacking to generate foreign currency. This revenue supports the country's economy and funds its nuclear program in the face of United Nations sanctions.

Changpeng Zhao, who founded Binance in 2017, posted on X that user funds are safe. Zhao, who pleaded guilty to a felony related to money laundering in 2023 and was pardoned by President Donald Trump in 2025, said the event looks like a hack on Binance. He added that as a shareholder, he expects all user funds to be fully covered.

South Korea's spy agency reported in December 2022 that North Korean hackers had stolen an estimated $1.1 billion in virtual assets over the preceding five years. More than half of that total was stolen in 2022 alone. The agency described North Korea's capacity to steal digital assets as among the best in the world.