Binance hack linked to North Korea

Binance, the world's largest cryptocurrency exchange, is recovering assets for users after a massive breach that drained roughly $6.3 billion in digital currency.

TRM, a U.S.-based blockchain intelligence firm, attributed the attack to TraderTraitor, a unit it identifies as North Korea's elite hacking group. TRM stated on its website on Thursday that it made this judgment with high confidence. The firm reported that an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains. Most of this transfer occurred in about 20 minutes, marking the largest cryptocurrency theft on record.

Chainalysis, another blockchain analysis company, reached a similar conclusion. Its co-founder and CEO, Jonathan Levin, wrote on X that the hack was likely done by the Democratic People's Republic of Korea group TraderTraitor. TRM noted that several features of the attack matched earlier North Korea-linked heists, including the $1.5 billion Bybit hack in February 2025, which the FBI also attributed to TraderTraitor.

Binance began recovering user assets on Friday. The company said it worked with blockchain partners to freeze roughly $3 billion in affected assets. Withdrawals were suspended but are expected to resume within the next day or two. Deposits remained unaffected during the outage. The exchange stated it will cover all losses.

Technical details suggest the breach began with a compromised laptop. A subsequent investigation uncovered additional points of entry. Binance said on X that it found no evidence of any wallet private key leak. The company plans to release more technical details when its probe is complete.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the incident raises questions about approval controls. He noted that the attack appears to have involved one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys and are connected to the internet.

A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice. The company has not officially confirmed the North Korean link but is investigating the matter.

Changpeng Zhao, also known as CZ, posted on X on Thursday that user funds are safe. He acknowledged that the theft looks like a hack on Binance. Although he stepped down as CEO in 2023 after pleading guilty to a felony related to money laundering, he added that as a shareholder, he expects all user funds will be fully covered. President Donald Trump pardoned Zhao in 2025.

Experts say North Korea has turned to crypto hacking as a source of foreign currency to support its economy and fund its nuclear program. South Korea's spy agency said in December 2022 that North Korean hackers had stolen an estimated 1.1 billion dollars in cryptocurrency and other virtual assets in the past five years. More than half of that amount was stolen in 2022 alone. The agency considered North Korea's capacity to steal digital assets among the best in the world.