North Korean Cyber Unit Linked to Record $6.3 Billion Binance Crypto Heist
A sophisticated cyberattack against Binance, the world’s largest cryptocurrency exchange, has drained $6.3 billion in digital assets in what analysts call the largest crypto theft on record. Blockchain security researchers say an elite North Korean hacking unit was likely behind the lightning-fast breach.
Binance confirmed on Friday that deposits remain unaffected, though withdrawals were paused and should resume over the next day or two. Working alongside industry partners, the exchange managed to freeze roughly $3 billion of the stolen funds. The company committed to covering all customer losses stemming from the breach.
An initial internal investigation pointed to a compromised laptop before revealing additional points of breach. The speed of the attack was extraordinary. Security firm TRM Labs reported that an attacker moved approximately USD 6.36 billion out of Binance wallets across ten blockchains, executing most of the transfers within roughly 20 minutes.
Lazarus Subunit Tied to Massive Drain
TRM Labs publicly attributed the attack to TraderTraitor, an elite North Korean cyber outfit. “We make this judgment with high confidence,” TRM stated, pointing out that “several features of this attack match earlier North Korea-linked heists, including the Bybit hack.” That 2025 attack on Bybit resulted in a $1.5 billion loss, according to the FBI. Jonathan Levin, co-founder and CEO of Chainalysis, echoed TRM’s findings, noting on social media that the operation was “likely done” by the same group.
According to the U.S. Treasury Department, TraderTraitor operates as part of the broader Lazarus Group, a state-backed syndicate targeting government and financial sectors globally. Federal prosecutors previously tied Lazarus to the notorious 2014 cyberattack on Sony Pictures Entertainment, an allegation detailed by the Justice Department in 2018.
Security analysts say Pyongyang relies heavily on digital heists to generate hard currency for its struggling economy and nuclear weapons program amid stringent U.N. Sanctions. In December 2022, South Korea’s intelligence agency revealed that North Korean hackers had seized 1.5 trillion won ($1.1 billion) in digital assets over five years, with more than half stolen in 2022 alone.
Security Questions and Exchange Response
The incident has drawn sharp criticism about Binance’s internal safeguards. Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, suggested the breach involved inadequate authorization controls. “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,” Gan explained, referring to internet-connected digital wallets that hold private security keys.
Binance countered on social media that it has found no evidence of a private key leak and promised additional technical details once its investigation concludes. The company stated its teams are working around the clock alongside law enforcement to identify those responsible.
Changpeng Zhao, who founded Binance in 2017 before stepping down as CEO in 2023 following a guilty plea for failing to prevent money laundering, weighed in on Thursday. Zhao, who received a presidential pardon from President Trump in 2025, assured followers on social media that user funds are safe. He acknowledged the event appeared to be a hack, adding that as a shareholder, he expects all customer funds to be fully restored.
Binance maintains that full service will be restored following security checks, and further details will be released upon the conclusion of the law enforcement probe.