Binance Heist: $6.3 billion stolen in alleged North Korean attack

Blockchain intelligence firm TRM reported on Thursday that a hacking group likely stole an estimated $6.3 billion in bitcoin and other digital assets from Binance. The firm identified the attackers as TraderTraitor, a unit it associates with North Korea. This event marks the largest cryptocurrency heist on record. The company is currently working to recover the funds for its users.

Binance has spent much of its history under scrutiny for its role in the crypto market. Founded in 2017 by Changpeng Zhao, the platform functions as a global marketplace for buying and selling digital currencies. It operates entirely online without a physical headquarters. Zhao, a former McDonald’s employee from Canada, moved the company from Canada to Japan after a local crypto crackdown. Since then, the firm has expanded into Jersey and Malta. It has since overtaken competitors like Coinbase and FTX to become the largest exchange by trade volume. Forbes estimates Zhao’s personal wealth exceeds $100 billion.

The company faced intense regulatory pressure in recent years. U.S. regulators under the Biden administration accused Binance of operating unregistered securities exchanges. Zhao pleaded guilty in 2024 to violating the Bank Secrecy Act. He became the first person sentenced to prison for that offense. Prosecutors alleged Binance allowed trades between U.S. users and users in Iran, violating sanctions. The company also failed to report suspicious transactions involving Hamas’ Al-Qassam Brigades and al-Qaida. Zhao stepped down as CEO and served four months in federal jail.

U.S. President Donald Trump granted Zhao a pardon in October of last year. Trump, who has become a supporter of the crypto industry, said Zhao was unfairly treated by his predecessor. The White House described the earlier legal action as part of a war on crypto. Trump received millions of dollars in campaign donations and inauguration funds from Zhao and Binance. The companies also supported Trump family crypto ventures, including World Liberty Financial. Binance denied any quid pro quo arrangement existed for the pardon.

Attorney Teresa Goody Guillen stated in an email that claims of preferential financial treatment by Binance were a misstatement of the public record. She referred to Zhao by his initials, CZ. The White House maintained that federal authorities had unfairly punished Zhao during the previous administration. The pardon allowed Zhao to return to his role as founder of the largest crypto exchange in the world.

Pyongyang has frequently used cryptocurrency to bypass United Nations sanctions. Experts say the nation seeks foreign currency to fund its nuclear weapons program. A South Korean spy agency considers North Korean crypto hackers among the most skilled globally. The theft underscores the exchange’s vulnerability despite its size and security measures.

Binance announced on Friday that it began recovering money for users. The company is collaborating with blockchain partners to freeze approximately $3 billion in affected assets. Zhao posted on the social media platform X that user funds are safe.