Binance freezes $3 billion after North Korean hackers steal $6.36 billion

A U.S. blockchain intelligence firm identified the North Korean hacking unit TraderTraitor as the likely perpetrator behind a breach of Binance that resulted in the theft of $6.36 billion. TRM stated in a report published on Thursday that the attacker moved the funds across ten different blockchains, with the bulk of the transfer occurring within a 20-minute window. The firm expressed high confidence in its attribution, noting that the attack’s characteristics align with previous heists linked to North Korea, including the 2025 hack of Bybit.

Binance, the world’s largest cryptocurrency exchange, announced on Friday that it is beginning the process of recovering assets for affected users. The company worked with blockchain partners to freeze approximately $3 billion in impacted assets. While deposits remained active during the incident, Binance suspended withdrawals. The exchange expects to resume those services within the next day or two and stated it will cover all user losses.

Initial findings from Binance suggested the incident began with a compromised laptop. A subsequent investigation revealed additional points of breach. The company reported on X that it found no evidence of a wallet private key leak. It plans to release further technical details once its internal probe concludes.

Jonathan Levin, co-founder and CEO of blockchain analysis firm Chainalysis, agreed with the North Korean connection. He wrote on X that the hack was likely executed by the DPRK group TraderTraitor. A Binance spokesperson told the media that the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, raised questions about the security controls in place at the time of the breach. Gan said the attack appears to have involved a single signature that granted the attacker a never-expiring, full-access token to a Binance hot wallet. These wallets store user private keys and are connected to the internet, making them more vulnerable to attacks than offline cold storage.

North Korea has increasingly relied on cryptocurrency hacking to generate foreign currency. This revenue supports the nation’s economy and funds its nuclear program amid strict U.N. sanctions. In December 2022, South Korea’s intelligence agency estimated that North Korean hackers had stolen $1.1 billion in virtual assets over the preceding five years. The agency described North Korea’s capacity to steal digital assets as among the best in the world.

Changpeng Zhao, the founder of Binance who stepped down as CEO in 2023, commented on the incident via X. Zhao, who received a presidential pardon in 2025, stated that user funds are safe. He acknowledged the event looks like a hack on the platform and said that, as a shareholder, he expects all user funds to be fully covered.

The theft stands as the largest cryptocurrency heist on record. In February of last year, the exchange Bybit suffered a $1.5 billion loss in a hack that the FBI attributed to North Korea and TraderTraitor. The current incident underscores the continued financial impact of state-sponsored cybercrime on the global digital asset market.