North Korea Linked to Record $6.36 Billion Binance Cryptocurrency Heist

A U.S.-based blockchain intelligence firm identified a North Korean hacking unit as the likely perpetrator behind a $6.36 billion theft from Binance, the world's largest cryptocurrency exchange. The firm, TRM, stated on Thursday that the attack was carried out by a group known as TraderTraitor, which it describes as the elite cyber unit of the Democratic People's Republic of Korea. TRM expressed high confidence in this attribution, noting that the scale of the theft makes it the largest cryptocurrency heist on record.

Binance confirmed that the hack impacted more than $6 billion in assets. The company announced on Friday that it has begun the process of recovering funds for affected users. Binance worked with blockchain partners to freeze approximately $3 billion in assets tied to the incident. The exchange stated that it will cover all losses resulting from the breach.

Operations at the exchange are currently disrupted. Binance reported that user deposits remained unaffected during the incident. However, withdrawals have been suspended and are expected to resume within the next day or two. An initial investigation by Binance suggested the incident may have started with a compromised laptop. A subsequent, deeper investigation uncovered additional points of breach within the system.

TRM detailed the mechanics of the attack in a post on its website. The firm said an attacker moved approximately $6.36 billion out of Binance wallets across ten different blockchains. Most of this transfer occurred in a span of about 20 minutes. TRM noted that several features of this attack align with previous North Korea-linked heists, specifically the $1.5 billion hack on the exchange Bybit in February of last year. The Federal Bureau of Investigation previously attributed the Bybit theft to the same North Korean group.

Chainalysis, another blockchain analysis company, reached a similar conclusion. Jonathan Levin, co-founder and CEO of Chainalysis, wrote on X that the Binance hack was likely executed by the DPRK group TraderTraitor. A Binance spokesperson addressed the potential ties to North Korea by saying the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

Experts indicate that North Korea relies heavily on cryptocurrency hacking to generate foreign currency. These funds support the country's troubled economy and finance its nuclear program. This activity has intensified following tough United Nations sanctions. In December 2022, South Korea's spy agency reported that North Korean hackers stole an estimated 1.5 trillion won, or $1.1 billion, in cryptocurrency and virtual assets over the previous five years. More than half of that amount was stolen in 2022 alone. The agency considered North Korea's capacity to steal digital assets to be among the best in the world.

Changpeng Zhao, known as CZ, founded Binance in 2017. He pleaded guilty to a felony in 2023 related to failing to prevent money laundering on the platform and stepped down as CEO. President Donald Trump pardoned Zhao in 2025. Zhao posted on X on Thursday that user funds are safe. He added that the theft does look like a hack on Binance. Although he no longer manages the company, Zhao stated that as a shareholder, he expects all user funds to be fully covered.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, raised questions about the approval controls in place at the time of the attack. Gan said the incident appears to involve a single signature that granted the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys and are connected to the internet. Binance stated on X that it found no evidence of any wallet private key leak. The company said it will release more technical details when its probe is complete.