Hackers steal $6.3 billion from Binance, the world's largest crypto exchange

A hacking group believed to be based in North Korea has stolen an estimated $6.3 billion in bitcoin and other digital assets from Binance, the world's largest cryptocurrency exchange. The theft, which blockchain intelligence firm TRM announced on Thursday, appears to be the largest cryptocurrency heist in history. The attackers targeted customer funds held on the platform, which operates as a global marketplace for buying and selling digital currencies.

Binance was founded in 2017 by Changpeng Zhao, a former McDonald's worker from Canada. The company began operations in Canada before moving to Japan following regulatory crackdowns. It has since expanded globally, including plans for locations in Jersey and Malta. Zhao, whom Forbes estimates is worth more than $100 billion, built Binance into the dominant player in the space. The company surpassed rivals like Coinbase and FTX by facilitating trades for billions of dollars in volume. It also funded a stablecoin and partnered with an Israeli payments processor.

The exchange has faced intense scrutiny for years. Regulators accused Binance of allowing trades between U.S. users and Iranian entities in violation of sanctions. They also alleged the company failed to report suspicious transactions involving groups such as Hamas’ Al-Qassam Brigades and al-Qaida. In 2024, Zhao became the first person sentenced to prison for violating the Bank Secrecy Act. He pleaded guilty and served four months in jail before stepping down as CEO.

Zhao’s legal troubles ended with a presidential pardon in October of last year. President Donald Trump, who received millions in crypto donations and supports several family-linked crypto ventures, granted the reprieve. Trump stated that Zhao was unfairly treated by his predecessor and vowed to stop attacks on the industry. The White House described the previous administration's actions as a war on crypto. Binance denied any quid pro quo existed between its support of the Trump family's businesses and the pardon. Attorney Teresa Goody Guillen called claims of preferential treatment a clear misstatement of the public record.

North Korea's interest in the theft stems from its need for foreign currency to develop nuclear weapons. Experts note that Pyongyang uses crypto to bypass U.N. sanctions. A South Korean spy agency considers North Korean hackers among the best in the world. TRM identified the likely perpetrators as TraderTraitor, a unit described as elite. The group has a history of targeting digital assets to fund the state's military programs.

Binance is now working to recover the lost funds. The company announced on Friday that it is collaborating with blockchain partners to freeze roughly $3 billion in affected assets. Zhao addressed users on the social platform X, stating that user funds are safe. The exchange continues to process claims and coordinate with technical partners to secure the remaining stolen value.