Binance Loses $6.3 Billion to North Korean Hackers in Record Heist

Binance, the largest cryptocurrency exchange globally, suffered a $6.3 billion loss in the largest cyber heist in history.

The breach occurred at 4:05 p.m. Eastern on Thursday when unauthorized actors accessed investor trading accounts. The group extracted just over $6.3 billion in cryptocurrency within 20 minutes. Experts identify the attackers as TraderTraitor, a sophisticated unit within the North Korean military known for previous high-value thefts.

This event follows a similar attack in 2025, when the same unit stole $1.5 billion from the crypto exchange Bybit. Ari Redbord, global head of policy at crypto research firm TRM Labs, described the scale of the theft as unprecedented. He noted that the speed of the transfer, moving billions of dollars at the speed of the internet, distinguished this incident from traditional financial crimes. Redbord stated that the group is not a commercial entity seeking profit alone but a military force using stolen funds for weapons proliferation and destabilizing activities.

Binance has frozen approximately $3 billion of the stolen assets with the help of partner exchanges. The company announced it will reimburse customers who lost funds, though it has not detailed the specific mechanism for these payments. Researchers are still analyzing whether specific security flaws at Binance allowed the initial access. Critics point to the structural design of crypto exchanges, where customers often leave digital currencies with the platform for safekeeping. This arrangement creates a large, centralized target for hackers.

Amanda Fischer, policy director at financial advocacy group Better Markets, compared the regulatory gap to traditional stock markets. She explained that investors on the New York Stock Exchange keep funds with regulated brokers who carry insurance. In contrast, crypto exchanges operate under a weaker framework, and Binance is not strictly bound by current regulations to return lost client funds. Fischer warned that smaller exchanges may lack the resources to reimburse investors after a similar breach. The incident follows the 2022 collapse of FTX, where the exchange used customer funds to cover losses, leading to the founder's conviction for fraud.

The next steps involve tracing the remaining unfrozen assets and determining the exact technical vulnerabilities exploited by the North Korean unit. Binance will coordinate with regulators to finalize the reimbursement process for affected users. The frozen funds remain in temporary custody pending a full forensic audit.