Binance Hack: North Korean Unit Linked to $6.3 Billion Theft

TRM, a U.S.-based blockchain intelligence firm, attributed a massive breach at Binance to a North Korean hacking unit on Thursday. The firm identified the group as TraderTraitor, describing it as the Democratic People’s Republic of Korea’s elite cyber division. TRM stated it made this judgment with high confidence, noting that the attack shares characteristics with previous North Korean heists.

An attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains. Most of the funds were transferred in about 20 minutes. This figure marks the largest cryptocurrency theft on record according to TRM. The company previously saw a similar event in February of last year when Bybit lost $1.5 billion in a hack attributed to the same North Korean unit.

Binance reported that deposits were unaffected by the incident. However, the exchange suspended withdrawals, which it expects to resume within the next day or two. The company stated it will cover all losses resulting from the breach. Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets.

The exchange initially suggested on X that the incident may have involved a compromised laptop. A subsequent investigation uncovered additional points of breach. A spokesperson for Binance said the company is working closely with law enforcement partners to confirm the identity of the criminals. The firm said it found no evidence of any wallet private key leak and will release more technical details when its probe is complete.

Jonathan Levin, co-founder and CEO of blockchain analysis company Chainalysis, wrote on X that the hack was likely done by the DPRK group TraderTraitor. He noted that several features of the attack match earlier North Korea-linked incidents. Experts say North Korea has turned to crypto hacking as a source of foreign currency to support its economy and fund its nuclear program in the face of U.N. sanctions.

Changpeng Zhao, who founded Binance in 2017, posted on X that user funds are safe. Zhao added that the theft looks like a hack on Binance. As a shareholder, he expects all user funds will be fully covered. Zhao stepped down as CEO in 2023 after pleading guilty to a felony linked to money laundering, and U.S. President Donald Trump pardoned him in 2025.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the event raises questions about approval controls. He noted that the attack appears to involve a single signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. These wallets hold users' private keys and are connected to the internet.