North Korea Linked to Record Binance Heist

A U.S.-based blockchain intelligence firm has attributed the largest cryptocurrency theft on record to a North Korean hacking unit, claiming high confidence in its assessment. The attack targeted Binance, the world’s largest cryptocurrency exchange, resulting in the movement of approximately $6.36 billion out of company wallets.

According to TRM, the attacker transferred funds across ten different blockchains, with the bulk of the $6.36 billion moving in about 20 minutes. TRM identified the perpetrator as TraderTraitor, a group it describes as North Korea’s elite hacking unit. The firm noted that several features of the breach match previous North Korea-linked heists, including a $1.5 billion hack at the exchange Bybit in February 2025, for which the FBI also cited TraderTraitor.

Chainalysis, another blockchain analysis company, concurred with the attribution. Its co-founder and CEO, Jonathan Levin, wrote on X that the incident was likely executed by the Democratic People’s Republic of Korea group. In response to inquiries, a Binance spokesperson stated that the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

Binance announced on Friday that it had frozen roughly $3 billion in affected assets in coordination with its blockchain partners. The company has begun the process of recovering assets for its users. Deposits remained unaffected by the incident, but withdrawals were suspended. Binance expects withdrawals to resume within the next day or two and has stated it will cover all resulting losses.

The exchange initially suggested the incident may have involved a compromised laptop, but subsequent investigations uncovered additional points of breach. On X, Binance said it found no evidence of a wallet private key leak and promised to release more technical details when its probe is complete. Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, suggested a weaker approval control allowed the attacker to obtain a never-expiring, full-access token to a hot wallet.

Changpeng Zhao, known as CZ, who founded Binance in 2017, commented on the event on X. Although he stepped down as CEO in 2023 following a guilty plea for failing to prevent money laundering, he noted that as a shareholder, he expects all user funds to be fully covered. President Donald Trump pardoned Zhao in 2025.

Experts indicate that North Korea has increasingly turned to cryptocurrency hacking to generate foreign currency. This funding supports the country's troubled economy and nuclear program amidst tough United Nations sanctions. In December 2022, South Korea’s spy agency reported that North Korean hackers had stolen an estimated $1.1 billion in virtual assets over the prior five years, with more than half of that sum taken in 2022 alone.