Binance Loses $6.36 Billion to Suspected North Korean Hack

Hackers moved 6.36 billion dollars out of Binance wallets across ten blockchains. The theft occurred mostly within a 20 minute window. This event stands as the largest cryptocurrency theft on record.

TRM, a U.S. based blockchain intelligence firm, linked the attack to TraderTraitor. The company described the group as North Korea's elite hacking unit. TRM stated in a Thursday post that it makes this judgment with high confidence.

Chainalysis, another blockchain analysis company, reached a similar conclusion. Co founder and CEO Jonathan Levin wrote on X that the hack was likely done by the DPRK group TraderTraitor. The acronym DPRK refers to the Democratic People's Republic of Korea.

Binance announced on Friday that it began recovering assets for users. The exchange said it worked with blockchain partners to freeze roughly 3 billion dollars in affected assets. Deposits were not affected during the incident. Withdrawals were suspended and are expected to resume within the next day or two.

The company said it will cover all losses. An initial investigation suggested a compromised laptop caused the incident. A subsequent review uncovered additional points of breach. Binance said on X that it found no evidence of any wallet private key leak. It plans to release more technical details when its probe is complete.

When asked about potential ties to North Korea, a Binance spokesperson said the company is working closely with law enforcement partners. The goal is to confirm the identity of the criminals and bring them to justice.

TRM noted that several features of this attack match earlier North Korea linked heists. The Bybit hack in February 2025 resulted in a 1.5 billion dollar loss. The FBI attributed that incident to North Korea and TraderTraitor.

Experts say North Korea uses crypto hacking to obtain foreign currency. The funds support its troubled economy and nuclear program. This activity continues despite tough U.N. sanctions. In December 2022, South Korea's spy agency said North Korean hackers stole an estimated 1.5 trillion won in virtual assets over five years. More than half of that amount was stolen in 2022 alone.

Changpeng Zhao, also known as CZ, founded Binance in 2017. He pleaded guilty to a felony related to money laundering in 2023 and stepped down as CEO. President Donald Trump pardoned Zhao in 2025. Zhao posted on X on Thursday that user funds are safe. He acknowledged the theft looks like a hack on Binance. As a shareholder, he expects all user funds to be fully covered.

Kok Tin Gan, co founder and CEO of cybersecurity firm NyxLab, raised questions about approval controls. Gan said the attack appears to have used a single signature. This signature gave the attacker a never expiring, full access token to a Binance hot wallet. Hot wallets hold private keys and are connected to the internet.