Binance Breach: North Korea Linked to $6.3B Crypto Theft

Binance, the largest cryptocurrency exchange globally, confirmed that withdrawals remain suspended as it begins recovering assets for users after a breach that impacted more than $6 billion. The company stated on Friday that it will cover all losses from the incident, which it described as involving a compromised laptop and additional points of breach.

TRM, a U.S.-based blockchain intelligence firm, attributed the attack to TraderTraitor, a unit it identified as North Korea's elite hacking group. In a post on its website Thursday, TRM stated it made the judgment with high confidence. The firm reported that an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, with most of the transfer completed in about 20 minutes. This figure marks the largest cryptocurrency theft on record.

Chainalysis, another blockchain analysis company, reached a similar conclusion. Co-founder and CEO Jonathan Levin wrote on X that the hack was likely done by the DPRK group TraderTraitor. TRM noted that several features of the attack match earlier North Korea-linked heists, including the February 2025 hack of Bybit, which resulted in a $1.5 billion loss.

Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets. The exchange confirmed that deposits were unaffected and expected withdrawals to resume within the next day or two. A Binance spokesperson told reporters the company is working closely with law enforcement partners to confirm the identity of the criminals.

Security experts point to a specific technical failure. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the attack appears to involve a signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. These wallets hold users' private keys and are connected to the internet. Binance stated it found no evidence of any wallet private key leak and will release more technical details when its investigation is complete.

The incident adds to a pattern of state-sponsored crypto theft. In December 2022, South Korea's spy agency reported that North Korean hackers had stolen an estimated $1.1 billion in digital assets over the previous five years. Analysts say North Korea uses these funds to support its economy and nuclear program under U.N. sanctions.

Changpeng Zhao, the founder of Binance, posted on X on Thursday that user funds are safe. Although he stepped down as CEO in 2023 after pleading guilty to a money laundering felony, Zhao said he expects all user funds to be fully covered as a shareholder. President Donald Trump pardoned Zhao in 2025.