North Korea Linked to $6.36 Billion Binance Heist

The largest cryptocurrency theft in history has been attributed to a North Korean hacking unit by two major intelligence firms.

TRM, a U.S.-based blockchain intelligence company, identified the group responsible for moving approximately $6.36 billion out of Binance wallets on ten different blockchains. The firm stated that the attacker executed the majority of the transfer in about 20 minutes. TRM described the unit as TraderTraitor, which it calls North Korea’s elite hacking team. The company expressed high confidence in this judgment. Chainalysis, another blockchain analysis firm, reached a similar conclusion. Its co-founder and CEO, Jonathan Levin, wrote on X that the hack was likely done by the Democratic People’s Republic of Korea group TraderTraitor.

Binance, the world’s largest cryptocurrency exchange, confirmed the incident on Friday. The company stated that deposits were not affected, but withdrawals were suspended and are expected to resume within one or two days. Binance said it would cover all losses. The exchange noted that it worked with blockchain partners to freeze roughly $3 billion in affected assets. An initial investigation suggested a compromised laptop was involved, but a subsequent probe uncovered additional points of breach. The company said it had found no evidence of any wallet private key leak and planned to release more technical details when its investigation is complete.

The attack shares characteristics with previous North Korea-linked heists, including the $1.5 billion hack of Bybit in February 2025. The FBI attributed that earlier incident to North Korea and TraderTraitor. Experts note that North Korea has increasingly used cryptocurrency hacking to generate foreign currency. The funds support its troubled economy and nuclear program in the face of U.N. sanctions. In December 2022, South Korea’s spy agency estimated that North Korean hackers had stolen $1.1 billion in virtual assets over the previous five years. More than half of that amount was stolen in 2022 alone.

Changpeng Zhao, who founded Binance in 2017, commented on the event on X. Zhao pleaded guilty to a felony related to money laundering in 2023 and stepped down as CEO. U.S. President Donald Trump pardoned him in 2025. Zhao stated that user funds are safe but acknowledged that the event looks like a hack on Binance. As a shareholder, he said he expects all user funds to be fully covered.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the incident raises questions about approval controls. Gan suggested the attacker may have used a single signature to obtain a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold private keys connected to the internet. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

Binance will continue its investigation and release further technical findings. The company maintains that it will cover all losses for affected users.