North Korea’s notorious hackers are once again being blamed for a massive cryptocurrency theft, this time a roughly $6.3 billion breach of Binance, the world’s largest crypto exchange, in what experts are calling the biggest crypto hack in history.
Two leading blockchain intelligence firms, TRM Labs and Chainalysis, tied the attack to TraderTraitor, a North Korean hacking unit that focuses almost exclusively on stealing crypto from large companies and exchanges. Blockchain security firm Elliptic also attributed the theft to North Korea.
Billions of dollars in crypto began draining out of Binance wallets on Thursday afternoon. According to TRM Labs, the attacker moved about $6.36 billion across ten blockchain networks, including Bitcoin, Ethereum, XRP Ledger, Solana and Tron, with most of it taken in about 20 minutes.
Binance quickly suspended all deposits and withdrawals, and crypto firms moved to freeze roughly $3 billion in assets connected to the theft. Binance said Friday it had begun recovering assets for users and expects withdrawal services to resume by Sunday morning.
An initial investigation suggested the hackers gained access through an engineer’s laptop. Binance said it has seen no evidence that its private keys were compromised.
TRM Labs said several features of the attack matched earlier North Korea-linked heists. Chainalysis reported that the strongest evidence came when its investigators watched, in real time, as stolen Binance funds were mixed with crypto taken in last month’s hack of the Bitget exchange, which had already been attributed to North Korea.
Chainalysis noted that once the hack began, the attacker raced to swap freezable assets, such as the USDT and USDC stablecoins, into assets that cannot be frozen, like Bitcoin and Ethereum.
Binance co-founder Changpeng Zhao, who stepped down as CEO in 2023, posted on X that “User funds are safe!” He added that while he no longer runs the company, “as a shareholder, I expect all user funds will be fully covered.” Binance has pledged to cover all losses tied to the incident.
Asked about the North Korea link, a Binance spokesperson said only that the company is working closely with law enforcement to confirm the identity of those responsible and bring them to justice.
The heist dwarfs the previous record, the roughly $1.5 billion theft from the Bybit exchange in February 2025, which was also blamed on North Korea. In that case, hackers took an amount equal to a significant portion of the country’s reported annual GDP in a matter of minutes.
U.S. and South Korean officials have long warned that Kim Jong Un’s hacking teams are a key source of cash for the nuclear-armed regime, which remains cut off from much of the global economy by sanctions. North Korean hackers stole a record $2.02 billion in crypto in 2025, according to Chainalysis, accounting for about 60% of all crypto stolen worldwide that year.
The regime’s operatives have increasingly relied on impersonating crypto executives and placing IT workers inside crypto companies to pull off fewer but larger attacks.
The amount stolen from Binance could still change as investigators continue tracing the funds.
