North Korean Hackers Drained $6.3 Billion From Binance in 20 Minutes
Blockchain intelligence firms attribute the record-setting theft to the elite unit TraderTraitor, while Binance works to freeze half the stolen funds.
By Rafael Delgado ·
A U.S.-based blockchain intelligence firm identified a North Korean hacking unit as the likely source behind a breach that emptied over $6 billion from Binance, the world's largest cryptocurrency exchange. The attack represents the largest cryptocurrency theft on record.
TRM, a blockchain intelligence company, published a report on its website on Thursday attributing the incident to TraderTraitor. The firm described the group as North Korea's elite hacking unit and stated it made the judgment with high confidence. An attacker moved approximately USD 6.36 billion out of Binance wallets across ten blockchains, with the majority of the transfer occurring in about 20 minutes.
Binance announced on Friday that it began recovering assets for its users. The exchange worked with blockchain partners to freeze roughly $3 billion in affected assets. Company officials stated that deposits remained unaffected, but withdrawals are suspended. Binance expects to resume withdrawal services within the next day or two and pledged to cover all losses.
Initial investigations by Binance suggested the incident involved a compromised laptop. Subsequent probes uncovered additional points of breach. The company posted on X that it found no evidence of a wallet private key leak and promised to release more technical details once the investigation concludes.
Chainalysis, another blockchain analysis company, agreed with TRM's assessment. Co-founder and CEO Jonathan Levin wrote on X that the hack was likely done by the DPRK group TraderTraitor. The acronym DPRK refers to the Democratic People's Republic of Korea, North Korea's official name.
Experts note that North Korea has increasingly relied on crypto hacking and illicit cyber activities to generate foreign currency. These funds support the country's struggling economy and its nuclear program in the face of tough United Nations sanctions. In December 2022, South Korea's spy agency reported that North Korean hackers had stolen an estimated 1.5 trillion won, or $1.1 billion, in digital assets over five years. More than half of that total was stolen in 2022 alone.
The current attack mirrors previous North Korea-linked heists, including the Bybit hack in February of last year. That incident resulted in a $1.5 billion loss. The FBI attributed the Bybit breach to North Korea and TraderTraitor. TRM noted that several features of the Binance attack match those earlier incidents.
Changpeng Zhao, also known as CZ, founded Binance in 2017. He pleaded guilty to a felony related to money laundering in 2023 and stepped down as CEO. U.S. President Donald Trump pardoned Zhao in 2025. Zhao posted on X on Thursday that user funds are safe. He acknowledged the theft looks like a hack on Binance and said he expects all user funds to be fully covered as a shareholder.
Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, questioned why stronger approval controls were not in place. He suggested the attacker used a single signature to gain a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys and are connected to the internet. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals.
