A U.S.-based blockchain intelligence firm has reported a significant hack on Binance, the world’s largest cryptocurrency exchange. The incident involved over $6 billion and is suspected to be orchestrated by a North Korean unit.
Binance responded by collaborating with blockchain partners to freeze about $3 billion in assets affected by the hack. They announced they are beginning the process of asset recovery for users. Although deposits remain unaffected, withdrawals have been temporarily halted and are set to resume shortly. Binance also committed to covering all user losses.
In a statement, Binance mentioned an initial investigation revealing a compromised laptop might have been involved. However, a deeper probe uncovered additional vulnerabilities.
“We make this judgment with high confidence,” said TRM, attributing the attack to TraderTraitor, describing it as an elite North Korean hacking unit.
According to TRM’s report, the hacker managed to transfer approximately $6.36 billion from Binance wallets across ten blockchains, predominantly in a short span of 20 minutes. This potentially ranks as the largest cryptocurrency heist recorded.
TRM noted similarities with other North Korean-linked cyber thefts, such as the February breach on Bybit that resulted in a loss of $1.5 billion. The FBI had also pointed to North Korea and TraderTraitor’s involvement in the Bybit incident. Supporting these claims, Chainalysis aimed at the same North Korean group.
A Binance spokesperson revealed ongoing collaboration with law enforcement to identify the perpetrators and ensure justice.
North Korea is believed to use crypto hacking and other cyber crimes to generate foreign currency needed for its economy and to support its nuclear program, particularly in light of stringent U.N. sanctions. In 2022, South Korea’s intelligence reported North Korea’s theft of cryptocurrency totaling 1.5 trillion won ($1.1 billion) over five years, with a majority occurring in 2022.
Binance’s founder, Changpeng Zhao, known as CZ, resigned as CEO after pleading guilty to a felony tied to money laundering on the platform in 2023. He was pardoned by U.S. President Donald Trump in 2025. Despite not managing Binance anymore, Zhao reassured on X that user funds are secure, though the event appeared to be a hack.
Kok Tin Gan, CEO of NyxLab, criticized the security protocols, suggesting a single authorization might have provided the attacker extensive access to a Binance hot wallet. He pointed out that these wallets contain users’ private keys and are connected online.
Binance confirmed no evidence of a private key leak and promised a detailed technical report after the investigation.