Binance hack linked to North Korea

Binance, the largest cryptocurrency exchange in the world, lost roughly $6.36 billion in a hack that analysts attribute to a North Korean unit. TRM, a U.S.-based blockchain intelligence firm, identified the attacker as TraderTraitor on Thursday. The firm stated it made the judgment with high confidence after analyzing the movement of funds across ten different blockchains.

TRM reported that the attacker moved the money in approximately 20 minutes. This event is now considered the largest cryptocurrency theft on record. Binance confirmed on Friday that it began recovering assets for users. The company froze about $3 billion in affected assets with the help of blockchain partners.

Binance suspended withdrawals for users, with resumption expected within the next day or two. Deposits were not affected by the breach. The exchange stated it will cover all losses resulting from the incident. An initial investigation suggested a compromised laptop was involved, but a subsequent review found additional points of breach.

Chainalysis, another blockchain analysis company, also linked the hack to North Korea. Co-founder and CEO Jonathan Levin wrote on X that the attack was likely carried out by the DPRK group TraderTraitor. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals. The exchange has not publicly confirmed the North Korean connection itself.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, noted that the attack appears to have exploited a single signature. He described it as a never-expiring, full-access token to a Binance hot wallet. Hot wallets are connected to the internet and hold unique digital authorizations known as private keys. Gan said this event raises questions about why stronger approval controls were not in place.

Binance stated on X that it found no evidence of any wallet private key leak. The company plans to release more technical details when its probe is complete. In 2023, Changpeng Zhao, also known as CZ, pleaded guilty to a felony related to failing to prevent money laundering on the platform. He stepped down as CEO that year, though President Donald Trump pardoned him in 2025.

Zhao posted on X on Thursday that user funds are safe. He acknowledged that the incident looks like a hack on Binance. As a shareholder, he said he expects all user funds to be fully covered. North Korea has increasingly used cryptocurrency hacking to gain foreign currency. Experts say the funds support the country's troubled economy and nuclear program in the face of United Nations sanctions.

In December 2022, South Korea's spy agency estimated that North Korean hackers stole 1.5 trillion won, or about $1.1 billion, in digital assets over the previous five years. More than half of that total was stolen in 2022 alone. The agency described North Korea's capacity to steal digital assets as among the best in the world. The FBI previously attributed the $1.5 billion Bybit hack in February 2025 to the same North Korean group.