Crypto Heist: North Korea Linked to $6.36 Billion Binance Breach

Approximately $6.36 billion flowed out of Binance wallets across ten blockchains in a span of about 20 minutes, according to blockchain intelligence firm TRM. This figure marks the largest cryptocurrency theft ever recorded. TRM posted its findings on its website Thursday, attributing the attack to TraderTraitor, which it identifies as North Korea's elite hacking unit. The firm stated it makes this judgment with high confidence.

Binance, the world's largest cryptocurrency exchange, confirmed the breach on Friday. The company said it worked with blockchain partners to freeze roughly $3 billion in affected assets. It announced that it has begun recovering assets for users. Binance stated that deposits were unaffected during the incident. Withdrawals were suspended but are expected to resume within the next day or two. The exchange said it will cover all losses.

TRM noted that several features of the attack match earlier North Korea-linked heists, including the Bybit hack in February of last year. In that incident, Bybit suffered a $1.5 billion loss. The FBI said North Korea and TraderTraitor were responsible for that breach. Jonathan Levin, co-founder and CEO of Chainalysis, also wrote on X that the Binance hack was likely done by the DPRK group TraderTraitor. DPRK is the official name for North Korea.

Binance said on X that an initial investigation suggested the incident may have involved a compromised laptop. A subsequent probe uncovered additional points of breach. A Binance spokesperson told the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice. The company said it found no evidence of any wallet private key leak. It plans to release more technical details when its probe is complete.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the event raises questions about why stronger approval controls were not in place. Gan said the attack looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys and are connected to the internet.

North Korea has turned to crypto hacking as a source of foreign currency to support its economy and fund its nuclear program. This strategy follows tough U.N. sanctions. In December 2022, South Korea's spy agency said North Korean hackers stole an estimated 1.5 trillion won in cryptocurrency and other virtual assets in the past five years. More than half of that amount was stolen in 2022 alone. The agency considered North Korea's capacity to steal digital assets among the best in the world.

Changpeng Zhao, also known as CZ, founded Binance in 2017. He pleaded guilty to a felony in 2023 related to failing to prevent money laundering and stepped down as CEO. U.S. President Donald Trump pardoned Zhao in 2025. Zhao posted on X Thursday that user funds are safe. He added that the theft does look like a hack on Binance. As a shareholder, Zhao said he expects all user funds will be fully covered.