North Korean Hackers Suspected in $6.3 Billion Binance Heist, Largest in Crypto History
Blockchain analysts say the TraderTraitor unit drained roughly $6.36 billion across ten blockchains in about 20 minutes. Binance says it froze about $3 billion and will cover all losses.
A North Korean state hacking unit is the likely culprit behind the theft of more than $6 billion from Binance, the world's largest cryptocurrency exchange, according to a U.S.-based blockchain intelligence firm. If the figures hold, it is the biggest crypto theft ever recorded.
TRM Labs estimates the attacker moved about $6.36 billion out of Binance wallets across ten blockchains, with most of the money leaving in roughly 20 minutes. In a post on Thursday, the firm attributed the attack to TraderTraitor, which it describes as North Korea's elite hacking unit, and said it made that judgment "with high confidence." It noted that several features of the attack match earlier North Korea-linked heists.
Jonathan Levin, the co-founder and chief executive of the analytics firm Chainalysis, wrote on social media that the hack was likely carried out by TraderTraitor as well. The same group was tied by the FBI to the February 2025 theft of $1.5 billion from the exchange Bybit, the previous record holder.
Binance said it worked with blockchain partners to freeze roughly $3 billion of the affected assets. Customer deposits were not affected, the company said, and withdrawals were suspended but expected to resume within a day or two. Binance has said it will cover all losses.
On Friday, Binance said in a social media post that an initial investigation suggested a compromised laptop may have been involved. A later review found additional "points of breach," the company said. Binance said it had "found no evidence of any wallet private key leak" and plans to publish more technical details once its investigation is finished. It said it is working with law enforcement to identify the perpetrators and bring them to justice.
Changpeng Zhao, known as CZ, founded Binance in 2017. He pleaded guilty in 2023 to a felony tied to failing to prevent money laundering on the platform and stepped down as chief executive. President Trump pardoned him in 2025. Zhao posted on Thursday that "User funds are safe!" and said the theft "does look like a hack on Binance." He no longer manages the company, he wrote, but as a shareholder he expects user funds to be fully covered.
Security specialists are already asking how an attacker could move so much so quickly. Kok Tin Gan, co-founder and chief executive of the cybersecurity firm NyxLab, said the incident raises questions about why stronger approval controls were not in place. In his reading, a single signature may have handed the attacker a permanent, full-access token to a Binance hot wallet. Hot wallets are cryptocurrency wallets connected to the internet that hold the private keys needed to authorize transactions. Gan's assessment is his own, and Binance has not confirmed it.
Experts say North Korea has leaned ever more heavily on crypto theft and other illicit cyber activity to earn foreign currency. The money is believed to help prop up its struggling economy and fund its nuclear program, in defiance of United Nations sanctions. In December 2022, South Korea's spy agency estimated that North Korean hackers had stolen about 1.5 trillion won, roughly $1.1 billion, in crypto and other virtual assets over the previous five years, with more than half of it taken in 2022 alone. The agency called the country's capacity for digital theft one of the best in the world.
By TRM's count, the Binance theft is more than four times the size of the Bybit heist. Binance has not said how long it will take to complete its forensic review or when it will release a full account of how the attackers got in.
