North Korea suspected in record $6.3 billion theft from Binance
Blockchain firms identify the elite hacking unit TraderTraitor as the likely culprit behind the largest cryptocurrency heist ever recorded.
By William Turner ·
North Korean hackers likely stole $6.36 billion from Binance, the world’s largest cryptocurrency exchange, according to a report from TRM, a U.S.-based blockchain intelligence firm. The theft represents the largest cryptocurrency heist on record.
TRM attributed the attack to TraderTraitor, a unit it describes as North Korea’s elite hacking group. The firm stated it made this judgment with high confidence. It noted that several features of the attack matched earlier North Korea-linked heists, including the $1.5 billion Bybit hack in February 2025.
The attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains. Most of the funds were moved in about 20 minutes. Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets. The company announced on Friday that it is beginning to recover assets for users.
Binance stated that deposits were unaffected. Withdrawals are suspended but are expected to resume within the next day or two. The exchange said it will cover all user losses. A spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals.
In a post on X, the company said an initial investigation suggested the incident may have involved a compromised laptop. A subsequent investigation uncovered additional points of breach. Binance said it found no evidence of any wallet private key leak and will release more technical details when its probe is complete.
Chainalysis, another blockchain analysis company, agreed with the assessment. Co-founder and CEO Jonathan Levin wrote on X that the hack was likely done by the DPRK group TraderTraitor. The DPRK is the official name of North Korea.
Changpeng Zhao, who founded Binance in 2017, posted on X that user funds are safe. He acknowledged that the theft looks like a hack on Binance. Although he stepped down as CEO in 2023 after pleading guilty to a felony related to money laundering, Zhao said he expects all user funds to be fully covered as a shareholder. President Donald Trump pardoned Zhao in 2025.
Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the event raises questions about why stronger approval controls were not in place. He described the breach as a single signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets are connected to the internet and hold users’ private keys.
Experts say North Korea has turned to crypto hacking to support its troubled economy and fund its nuclear program. The country faces tough U.N. sanctions. In December 2022, South Korea’s spy agency estimated that North Korean hackers had stolen $1.1 billion in cryptocurrency and other virtual assets in the previous five years. More than half of that amount was stolen in 2022 alone.
