A North Korean hacking unit was likely behind a theft of about $6.36 billion from Binance, the world’s biggest cryptocurrency exchange, according to two blockchain intelligence firms. If confirmed, it would be the largest crypto theft on record.
TRM Labs said in a post on its website that an attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes. The firm attributed the attack to TraderTraitor, which it describes as North Korea’s elite hacking unit. “We make this judgment with high confidence,” TRM said. Chainalysis co-founder and CEO Jonathan Levin wrote on X that the hack was “likely done by DPRK group TraderTraitor.”
Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets and has begun recovering funds for users. Deposits were unaffected. Withdrawals are suspended and should resume within a day or two. The company says it will cover all losses.
What Binance Says Happened
Binance first said its investigation pointed to a compromised laptop. Later work found additional “points of breach.” The company said it had “found no evidence of any wallet private key leak” and will publish more technical details when its probe ends. Asked about North Korea, a spokesperson said Binance is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.”
Founder Changpeng Zhao, who no longer runs the company, posted on X that “User funds are safe!” He said the theft “does look like a hack on Binance” and that, as a shareholder, he expects all user funds to be fully covered.
A Familiar Pattern
TRM said several features of the attack match earlier North Korea-linked heists, including the $1.5 billion Bybit hack in February last year. The FBI blamed North Korea and TraderTraitor for that attack.
Experts say North Korea turned to crypto theft as a source of foreign currency. Tough UN sanctions have squeezed its economy, and the money helps fund its nuclear program. In December 2022, South Korea’s spy agency estimated that North Korean hackers had stolen about $1.1 billion in virtual assets over five years. It called the country’s capacity to steal digital assets among the best in the world.
Questions About Security Controls
Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, questioned why stronger approval controls were not in place. “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,” he said. Hot wallets are connected to the internet and hold users’ private keys digitally.
Zhao founded Binance in 2017. He pleaded guilty in 2023 to a felony linked to failing to prevent money laundering and stepped down as CEO. President Donald Trump pardoned him in 2025.
Stay informed. Subscribe to the JournalTodays Newsletter for the latest cybersecurity news, cryptocurrency coverage, and technology updates delivered straight to your inbox.
