A U.S.-based blockchain intelligence firm stated that a North Korean unit was likely responsible for a hack impacting more than $6 billion on Binance, the world’s largest cryptocurrency exchange. Binance reported that it collaborated with blockchain partners to freeze approximately $3 billion in affected assets and announced it was starting to recover assets for users.
Investigation and Scale of the Hack
The cryptocurrency exchange explained that customer deposits remained unaffected, while withdrawals were suspended and anticipated to resume within a day or two, adding that the company will cover all losses. Initially, Binance posted on X that an initial inquiry indicated a compromised laptop might have been involved, though a subsequent probe revealed additional breach points.
In a website post, blockchain intelligence firm TRM attributed the attack to TraderTraitor, identifying it as North Korea’s elite hacking unit, stating they made the judgment with high confidence. TRM reported that an attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains, mostly within a 20-minute window, which would constitute the largest cryptocurrency theft on record.
TRM noted that several characteristics of this attack align with previous North Korea-linked heists, including a $1.5 billion hit suffered by the Bybit cryptocurrency exchange in February of the previous year, which the FBI attributed to North Korea and TraderTraitor. Chainalysis co-founder and CEO Jonathan Levin also wrote on X that his blockchain analysis company believed the Binance hack was likely executed by the DPRK group TraderTraitor, using the acronym for the Democratic People’s Republic of Korea.
When questioned about potential North Korean ties, a Binance spokesperson stated only that the firm is working closely with law enforcement partners to confirm the criminals’ identities and bring them to justice. Meanwhile, Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, raised questions regarding why stronger approval controls were absent, suggesting the incident resembled a single signature providing an attacker with a never-expiring, full-access token to a hot wallet. Binance responded on X that it found no evidence of any wallet private key leak and promised to release further technical details upon completing its investigation.
Broader Context and Reactions
Experts indicate that North Korea has increasingly utilized crypto hacking and other illicit cyber operations to generate critical foreign currency, supporting its struggling economy and funding its nuclear program amid strict U.N. sanctions and other challenges. South Korea’s spy agency reported in December 2022 that North Korean hackers had stolen an estimated 1.5 trillion won, equivalent to $1.1 billion, in cryptocurrency and other virtual assets over the preceding five years, with more than half occurring in 2022 alone, ranking the nation’s digital asset theft capacity among the global best.
Changpeng Zhao, also known as CZ, established Binance in 2017, pleaded guilty in 2023 to a felony related to failing to prevent money laundering on the platform, and stepped down as CEO before receiving a pardon from U.S. President Donald Trump in 2025. Zhao wrote on X that user funds were safe, observed that the theft appeared to be a Binance hack, and stated that although he no longer manages the company, he expected all user funds to be fully covered as a shareholder.
