Binance Loses $6.36 Billion to Suspected North Korean Hack
Two blockchain intelligence firms attribute the massive theft to the elite unit TraderTraitor, marking the largest cryptocurrency heist in history.
By Yara Nasser ·
Binance, the largest cryptocurrency exchange in the world, suffered a loss of $6.36 billion in a cyberattack that analysts believe was executed by North Korea. The theft represents the largest known cryptocurrency heist to date, surpassing the $1.5 billion hack of Bybit in February 2025. An attacker moved the funds across ten different blockchains in a period of approximately 20 minutes.
U.S.-based blockchain intelligence firm TRM attributed the attack to a group called TraderTraitor. The firm described the unit as North Korea’s elite hacking team and stated it made the judgment with high confidence. TRM noted that several features of the incident matched earlier heists linked to North Korea, including the previous attack on Bybit. Chainalysis, another blockchain analysis company, agreed with this assessment. Jonathan Levin, co-founder and CEO of Chainalysis, wrote on X that the hack was likely done by the DPRK group TraderTraitor.
Binance announced on Friday that it has frozen roughly $3 billion in affected assets with the help of blockchain partners. The company stated that deposits were not impacted by the breach. Withdrawals were suspended immediately following the incident but are expected to resume within one or two days. Binance said it will cover all user losses from the theft.
The exchange initially suggested on X that the incident may have involved a compromised laptop. A subsequent investigation uncovered additional points of breach. A Binance spokesperson told the Associated Press that the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice. The company said it found no evidence of any wallet private key leak and plans to release more technical details when its probe is complete.
North Korea has increasingly relied on cybercrime to generate foreign currency. The revenue helps support the country’s troubled economy and funds its nuclear program in the face of United Nations sanctions. In December 2022, South Korea’s spy agency reported that North Korean hackers stole an estimated $1.1 billion in virtual assets over five years. More than half of that total was taken in 2022 alone. The agency considered North Korea’s ability to steal digital assets among the best in the world.
Changpeng Zhao, who founded Binance in 2017, reacted to the news on social media. Zhao pleaded guilty to a felony related to money laundering in 2023 and stepped down as CEO. President Donald Trump pardoned him in 2025. Zhao posted that user funds are safe but acknowledged the event looks like a hack on Binance. As a shareholder, he expects all user funds to be fully covered despite no longer managing the company.
Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, raised questions about internal controls. He suggested the breach involved a single signature that granted the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets store private keys digitally and are connected to the internet. Gan’s assessment highlights the specific technical vulnerability that allowed the rapid transfer of billions of dollars.
