Binance confirms $6.36 billion theft linked to North Korean unit

A suspected North Korean hacking group stole $6.36 billion from Binance, the largest cryptocurrency theft in history. The world's largest crypto exchange confirmed the breach on Friday, stating it is now returning assets to users after freezing a portion of the stolen funds.

Binance reported that the attackers moved the money across ten different blockchains in approximately 20 minutes. The company said it successfully froze roughly $3 billion of the affected assets. Deposits to the platform remained open during the incident, but withdrawals were suspended. The exchange expects withdrawals to resume within one to two days.

Binance stated it will cover all user losses. The company initially suggested the incident involved a compromised laptop. A subsequent investigation revealed additional points of breach. The exchange said it found no evidence that wallet private keys were leaked.

TRM, a U.S.-based blockchain intelligence firm, attributed the attack to TraderTraitor on Thursday. The firm described TraderTraitor as North Korea's elite hacking unit. TRM said it made this judgment with high confidence. The company noted that several features of the attack matched earlier heists linked to North Korea, including a $1.5 billion hack on Bybit in February 2025.

Chainalysis, another blockchain analysis company, agreed with the attribution. Jonathan Levin, co-founder and CEO of Chainalysis, wrote on X that the hack was likely done by the Democratic People's Republic of Korea group TraderTraitor. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the attack raised questions about approval controls. Gan noted that the attacker appeared to use a single signature to obtain a never-expiring, full-access token for a Binance hot wallet. Hot wallets hold private keys and are connected to the internet.

Changpeng Zhao, who founded Binance in 2017, posted on X that user funds are safe. Zhao, who pleaded guilty to a money laundering felony in 2023 and stepped down as CEO, added that the incident looks like a hack on Binance. He stated that as a shareholder, he expects all user funds to be fully covered. President Donald Trump pardoned Zhao in 2025.

North Korea has used cryptocurrency hacking to generate foreign currency for its economy and nuclear program. In December 2022, South Korea's spy agency reported that North Korean hackers stole an estimated $1.1 billion in digital assets over the previous five years. The agency described North Korea's capacity to steal digital assets as among the best in the world.

Binance said it will release more technical details when its probe is complete. The company continues to coordinate with partners to recover the remaining unfrozen assets.