Binance confirms North Korean hackers stole $6.36 billion in crypto

The world's largest cryptocurrency exchange is currently dealing with the single largest theft in digital currency history. Binance stated on Friday that it is beginning the process of recovering assets for its users. The company confirmed that withdrawals are suspended but are expected to resume within the next day or two.

Blockchain intelligence firm TRM attributed the attack to TraderTraitor. The firm described this group as North Korea's elite hacking unit. TRM posted on its website on Thursday that it made this judgment with high confidence. The attacker moved approximately 6.36 billion U.S. dollars out of Binance wallets across ten blockchains. Most of the funds were moved in about 20 minutes.

Binance announced that it worked with blockchain partners to freeze roughly 3 billion dollars in affected assets. The company stated that deposits were unaffected during the incident. A Binance spokesperson said the company will cover all losses. The exchange noted that an initial investigation suggested the incident may have involved a compromised laptop. A subsequent investigation uncovered additional points of breach.

Jonathan Levin, co-founder and CEO of blockchain analysis company Chainalysis, also believed the hack was likely done by the North Korean group. He used the acronym DPRK to refer to the Democratic People's Republic of Korea. Levin posted this assessment on the social media platform X. The FBI previously linked TraderTraitor to a 1.5 billion dollar hack on the exchange Bybit in February of last year.

TRM stated that several features of the current attack match earlier North Korea-linked heists. These include the Bybit hack. Experts note that North Korea has turned to crypto hacking as a source of foreign currency. This revenue helps support its troubled economy and funds its nuclear program. The country faces tough United Nations sanctions and other economic difficulties.

In December 2022, South Korea's spy agency estimated that North Korean hackers had stolen 1.5 trillion won in cryptocurrency over five years. This amount equated to 1.1 billion U.S. dollars at the time. More than half of that total was stolen in 2022 alone. The agency considered North Korea's capacity to steal digital assets to be among the best in the world.

Changpeng Zhao, known as CZ, founded Binance in 2017. He pleaded guilty to a felony in 2023 related to failing to prevent money laundering on the platform. Zhao stepped down as CEO at that time. U.S. President Donald Trump pardoned Zhao in 2025. Zhao posted on X on Thursday that user funds are safe. He acknowledged that the theft looks like a hack on Binance. He added that he expects all user funds to be fully covered as a shareholder.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the event raises questions about approval controls. He described the incident as a signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys and are connected to the internet. Binance said on X that it found no evidence of any wallet private key leak. The company said it would release more technical details when its probe is complete.