North Korea Linked to Record $6.3B Binance Hack

Approximately $6.36 billion in digital assets moved out of Binance wallets across ten different blockchains in a span of about 20 minutes, according to blockchain intelligence firm TRM. The firm attributed the attack to TraderTraitor, which it described as the elite hacking unit of North Korea.

TRM stated on its website Thursday that it makes this judgment with high confidence. The company noted that several features of the attack match earlier North Korea-linked heists, specifically the $1.5 billion hack on Bybit in February 2025, for which the FBI previously held the same group responsible.

Jonathan Levin, co-founder and CEO of blockchain analysis company Chainalysis, also identified the likely perpetrators. In a post on X, Levin wrote that the Binance hack was likely done by the Democratic People’s Republic of Korea group TraderTraitor.

Binance, the world’s largest cryptocurrency exchange, announced Friday that it began recovering assets for users. The company said it worked with blockchain partners to freeze roughly $3 billion in affected assets. Deposits were unaffected by the incident, but withdrawals have been suspended and are expected to resume within the next day or two.

The exchange stated that it will cover all losses. An initial investigation suggested the incident may have involved a compromised laptop, but a subsequent review uncovered additional points of breach. Binance said on X that it found no evidence of any wallet private key leak and plans to release more technical details when its probe is complete.

Changpeng Zhao, the founder of Binance, posted on X Thursday that user funds are safe. Zhao added that the theft does look like a hack on Binance. Although he does not manage the company anymore, he said that as a shareholder, he expects all user funds will be fully covered.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, raised questions about the company's security controls. Gan said the incident looks like one signature gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets are cryptocurrency wallets that hold users’ private keys and are connected to the internet.

Experts note that North Korea has turned to crypto hacking and other illicit cyber activities as a source of foreign currency to support its economy and fund its nuclear program. This strategy has intensified following tough U.N. sanctions and other difficulties. South Korea’s spy agency reported in December 2022 that North Korean hackers stole an estimated $1.1 billion in cryptocurrency and other virtual assets in the five years prior, with more than half of that total occurring in 2022 alone.

A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice. Zhao pleaded guilty in 2023 to a felony linked to failing to prevent money laundering on the platform and stepped down as CEO. U.S. President Donald Trump pardoned Zhao in 2025.

The recovery process is currently underway as Binance works to return funds to affected accounts. The exchange expects to resume withdrawals soon, subject to the completion of its internal investigation and external coordination with law enforcement agencies.