Cryptocurrency Theft: North Korea Linked to $6.36 Billion Binance Hack

Binance has begun returning stolen cryptocurrency to its users after a massive breach that drained approximately $6.36 billion from the platform. The world's largest cryptocurrency exchange announced on Friday that it is recovering assets for affected customers. It stated that deposits were not impacted by the incident. Withdrawals, however, remain suspended and are expected to resume within the next day or two. Binance said it will cover all losses.

The company said in a post on X that an initial investigation pointed to a compromised laptop. A subsequent probe uncovered additional points of breach. The exchange stated it found no evidence of a wallet private key leak. It promised to release more technical details when its investigation is complete.

Two U.S.-based blockchain intelligence firms identified the attacker as a North Korean unit. TRM published a report on Thursday attributing the attack to TraderTraitor. The firm described TraderTraitor as North Korea’s elite hacking unit. TRM stated it made this judgment with high confidence. Chainalysis reached a similar conclusion. Its co-founder and CEO, Jonathan Levin, wrote on X that the hack was likely done by the DPRK group TraderTraitor.

TRM reported that an attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains. Most of the funds were moved in about 20 minutes. This amount makes the incident the largest cryptocurrency theft on record. The firm noted that several features of the attack match earlier North Korea-linked heists.

In February 2025, the exchange Bybit suffered a $1.5 billion loss due to a hack. The FBI attributed that incident to North Korea and TraderTraitor. TRM said the current breach shares similarities with the Bybit theft. A Binance spokesperson told reporters that the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

Cybersecurity experts point to the financial motives behind the attack. They say North Korea uses crypto hacking to obtain foreign currency for its economy and nuclear program. This activity continues despite tough U.N. sanctions. In December 2022, South Korea’s spy agency reported that North Korean hackers stole an estimated 1.5 trillion won in cryptocurrency over five years. More than half of that total was taken in 2022 alone.

Changpeng Zhao, also known as CZ, founded Binance in 2017. He stepped down as CEO in 2023 after pleading guilty to a felony related to money laundering. President Donald Trump granted Zhao a pardon in 2025. Zhao posted on X on Thursday that user funds are safe. He added that the theft looks like a hack on Binance. As a shareholder, he said he expects all user funds to be fully covered.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, raised questions about approval controls at Binance. He said the incident appears to involve a single signature that gave an attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets are internet-connected digital vaults that hold users' private keys. These keys act as unique authorizations for moving funds.

Binance will continue its internal investigation. The company plans to share further technical findings in the coming days. It has paused withdrawals to protect the remaining assets in its systems. The exchange is coordinating with blockchain partners to freeze the remaining $3 billion in affected assets.