Binance Hack: North Korea Linked to $6.3B Theft

Binance has started the process of recovering funds for users following a breach that impacted more than $6 billion. The exchange announced on Friday that withdrawals, which were suspended during the investigation, are expected to resume within the next day or two. The company stated it will cover all losses resulting from the incident.

Blockchain intelligence firm TRM attributed the attack to a North Korean unit known as TraderTraitor. In a post published on its website on Thursday, TRM stated it made this judgment with high confidence. The firm noted that several features of the attack matched earlier heists linked to North Korea, including the Bybit hack in February of last year.

TRM reported that an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains. Most of this transfer occurred in about 20 minutes. If confirmed, this event stands as the largest cryptocurrency theft on record.

Chainalysis, another major blockchain analysis company, concurred with this assessment. Co-founder and CEO Jonathan Levin wrote on X that the hack was likely executed by the DPRK group TraderTraitor. The Democratic People's Republic of Korea, or North Korea, has increasingly used cyber activities to generate foreign currency to support its economy and nuclear program amid U.N. sanctions.

Binance stated on X that an initial investigation suggested a compromised laptop was the entry point. However, a subsequent probe uncovered additional points of breach. The company said it worked with blockchain partners to freeze roughly $3 billion in affected assets. Deposits were not affected during the disruption.

A spokesperson for Binance said the company is working closely with law enforcement partners to confirm the identity of the criminals. When asked about potential ties to North Korea, the spokesperson did not offer a definitive confirmation but emphasized the ongoing collaboration with authorities to bring the perpetrators to justice.

Cybersecurity experts question the approval controls that allowed such a large transfer. Kok Tin Gan, cofounder and CEO of NyxLab, suggested the breach involved a single signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys and are connected to the internet.

Binance countered that it found no evidence of any wallet private key leak. The exchange plans to release more technical details once its investigation is complete. Changpeng Zhao, who founded Binance in 2017 and stepped down as CEO in 2023, posted on X on Thursday that user funds are safe. Zhao added that as a shareholder, he expects all user funds to be fully covered.

The incident follows a $1.5 billion hack on the Bybit exchange in February of last year. The FBI stated that North Korea and TraderTraitor were responsible for that earlier theft. South Korea's spy agency reported in December 2022 that North Korean hackers had stolen an estimated $1.1 billion in virtual assets over the previous five years. More than half of that amount was stolen in 2022 alone.

Zhao pleaded guilty to a felony in 2023 related to failing to prevent money laundering on the platform. U.S. President Donald Trump granted Zhao a pardon in 2025. The current breach has renewed scrutiny on the internal security protocols of the world's largest cryptocurrency exchange.