North Korea suspected in record $6.3 billion theft from Binance

Global cryptocurrency markets are grappling with the largest theft in digital asset history. Two major blockchain intelligence firms have linked the breach of Binance, the world's largest cryptocurrency exchange, to a North Korean hacking unit.

TRM, a U.S.-based intelligence firm, attributed the attack to TraderTraitor, which it identified as North Korea's elite hacking unit. The firm stated it made this judgment with high confidence. Chainalysis, another leading analysis company, reached a similar conclusion. Jonathan Levin, co-founder and CEO of Chainalysis, wrote on X that the hack was likely executed by the group. Both firms noted that several features of the attack matched earlier North Korea-linked heists.

According to TRM, an attacker moved approximately 6.36 billion U.S. dollars out of Binance wallets across ten blockchains. The majority of these funds were transferred in about 20 minutes. This figure surpasses the 1.5 billion dollar loss suffered by exchange Bybit in February 2025, which the FBI also attributed to North Korea and TraderTraitor.

Binance confirmed the scale of the incident on Friday. The company announced that it froze roughly 3 billion dollars in affected assets with the help of blockchain partners. Deposits remained unaffected during the outage. Withdrawals were suspended but are expected to resume within one or two days. Binance stated it will cover all losses resulting from the breach.

The exchange provided technical details regarding the cause of the failure. An initial investigation suggested a compromised laptop was involved. Subsequent probes uncovered additional points of breach. Binance said it found no evidence of a wallet private key leak. The company plans to release more technical specifics once its internal probe is complete.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, raised questions about internal controls. He suggested the attacker used a single signature to obtain a never-expiring, full-access token to a Binance hot wallet. Hot wallets are digital storage units connected to the internet that hold unique authorizations for transactions.

Changpeng Zhao, the founder of Binance, posted on X on Thursday to reassure investors. He stated that user funds are safe. Zhao added that while he no longer manages the company, he expects all user funds to be fully covered as a shareholder. The former CEO pleaded guilty to a money laundering felony in 2023 and was pardoned by President Donald Trump in 2025.

Binance is working with law enforcement partners to confirm the identity of the criminals. Experts note that North Korea relies on crypto hacking to generate foreign currency. This revenue helps support its economy and fund its nuclear program in the face of United Nations sanctions. In December 2022, South Korea's spy agency reported that North Korean hackers had stolen an estimated 1.1 billion dollars in virtual assets over the previous five years.