Binance: North Korean unit linked to $6.3B crypto theft

Binance, the world's largest cryptocurrency exchange, confirmed on Friday that it is beginning to recover assets for users following a hack that drained more than $6 billion from its wallets. The company stated that deposits remain unaffected and that it will cover all financial losses. Withdrawals were suspended during the incident and are expected to resume within the next two days.

Blockchain intelligence firm TRM attributed the attack to TraderTraitor, a hacking unit based in North Korea. In a post on its website Thursday, the firm said it made the judgment with high confidence. TRM noted that an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains. The majority of the funds were transferred in about 20 minutes.

TRM identified this incident as the largest cryptocurrency theft on record. The firm pointed out that several features of the attack matched previous North Korea-linked heists, including the Bybit hack. In February 2025, the Bybit exchange suffered a $1.5 billion loss. The FBI later determined that North Korea and TraderTraitor were responsible for that specific breach.

Chainalysis, another major blockchain analysis company, reached a similar conclusion. Co-founder and CEO Jonathan Levin wrote on X that the Binance hack was likely done by the Democratic People's Republic of Korea group TraderTraitor. A Binance spokesperson told the Associated Press that the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

The exchange provided initial technical details on X. An early investigation suggested the incident may have involved a compromised laptop. A subsequent probe uncovered additional points of breach. Binance stated that it found no evidence of any wallet private key leak and said it would release more technical details when its investigation is complete.

Changpeng Zhao, who founded Binance in 2017, reacted to the news on social media. Zhao pleaded guilty to a felony in 2023 related to money laundering and stepped down as CEO. President Donald Trump pardoned Zhao in 2025. In a post on X Thursday, Zhao wrote that user funds are safe but that the theft looks like a hack on Binance. As a shareholder, he said he expects all user funds will be fully covered.

Security experts are examining why stronger approval controls were not in place to prevent the transfer. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, suggested the attacker used a specific vulnerability. He described the issue as a single signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys digitally and are connected to the internet.

North Korea has increasingly turned to crypto hacking as a source of foreign currency. The funds support its economy and nuclear program in the face of U.N. sanctions. In December 2022, South Korea's spy agency reported that North Korean hackers had stolen an estimated $1.1 billion in virtual assets over the previous five years. More than half of that total was stolen in 2022 alone. The agency considered North Korea's capacity to steal digital assets among the best in the world.

Binance has frozen roughly $3 billion in affected assets with the help of blockchain partners. The company is now in the process of returning the remaining funds to its users. The exchange continues its internal review to determine the full scope of the technical failures involved.