North Korean Hackers Linked to Record $6.3 Billion Binance Crypto Theft
A massive cyber heist draining over $6 billion from Binance has been tied to North Korea’s elite hacking unit, according to leading blockchain security firms. In what analysts describe as the largest cryptocurrency theft in history, an intruder drained approximately $6.36 billion out of Binance wallets across ten blockchains, executing the bulk of the transfers in roughly 20 minutes.
U.S.-based blockchain intelligence firm TRM posted its findings Thursday, attributing the raid to TraderTraitor, a notorious cyber unit operated by the Democratic People’s Republic of Korea. “We make this judgment with high confidence,” TRM stated, pointing out that “several features of this attack match earlier North Korea-linked heists, including the Bybit hack.” That previous breach targeted exchange Bybit in February last year, resulting in a $1.5 billion loss that the FBI attributed to North Korea and TraderTraitor.
Jonathan Levin, co-founder and CEO of blockchain analysis firm Chainalysis, echoed those findings on X, writing that the breach was “likely done by DPRK group TraderTraitor.”
Binance Moves to Recover Funds and Safeguard Users
Binance announced Friday that it has begun recovering assets for affected clients after collaborating with industry partners to freeze roughly $3 billion in stolen funds. The exchange confirmed that user deposits remain completely safe, though customer withdrawals were temporarily suspended. Binance stated it expects to resume withdrawal services within the next day or two and pledged to cover all financial losses.
Initial statements from Binance on X indicated a compromised laptop might have initiated the breach, though follow-up inquiries revealed multiple “points of breach.” Respondng to queries about North Korean involvement, a Binance spokesperson declined to confirm specific nation-state links, stating only that the company is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.”
Changpeng Zhao, who founded Binance in 2017 and stepped down as CEO in 2023 after pleading guilty to a felony money laundering charge before receiving a pardon from U.S. President Donald Trump in 2025, commented on the situation via X on Thursday. While acknowledging he no longer manages daily operations, Zhao posted that “User funds are safe!” and noted that “as a shareholder, I expect all user funds will be fully covered.”
Questions Over System Safeguards
Industry analysts note that North Korea routinely relies on illicit cyber activity to bypass U.N. Sanctions, securing foreign currency for its economy and nuclear program. South Korea’s intelligence agency reported in December 2022 that North Korean hackers had seized an estimated 1.5 trillion won ($1.1 billion) in digital assets over the preceding five years, with more than half stolen in 2022 alone.
The sheer speed of the Binance breach has raised sharp security concerns. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, questioned the exchange’s internal access controls, noting, “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet.”
Binance denied that any core security credentials had been directly exposed, posting on X that it had “found no evidence of any wallet private key leak” and promising to publish a full technical report once its investigation concludes.