Binance freezes billions after North Korean unit steals $6.3 billion
Blockchain analysts attribute the record theft to TraderTraitor, prompting Binance to suspend withdrawals and promise full reimbursement for affected users.
By Fatou Mitchell ·
Binance, the world’s largest cryptocurrency exchange, froze approximately $3 billion in assets following a breach that resulted in the theft of $6.36 billion. The exchange announced on Friday that it began recovering funds for users while suspending withdrawals, which are expected to resume within the next 48 hours. Binance stated that deposits remained unaffected and that the company would cover all losses from the incident.
TRM, a U.S.-based blockchain intelligence firm, attributed the attack to TraderTraitor, a hacking unit linked to North Korea. In a post on its website on Thursday, TRM stated it made this judgment with high confidence. The firm noted that an attacker moved funds across ten blockchains, with the bulk of the transfer occurring in about 20 minutes. This event stands as the largest cryptocurrency theft on record.
Chainalysis, another blockchain analysis company, reached a similar conclusion. Co-founder and CEO Jonathan Levin wrote on X that the hack was likely executed by the TraderTraitor group. TRM observed that several features of the attack matched previous North Korea-linked heists, including the $1.5 billion hack of the exchange Bybit in February 2025. The FBI previously identified North Korea and TraderTraitor as responsible for the Bybit breach.
Binance said an initial investigation suggested the incident involved a compromised laptop, but subsequent reviews uncovered additional points of breach. The company stated on X that it found no evidence of any wallet private key leak. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.
Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, said the incident raises questions about approval controls. He noted that the attack appears to have involved a single signature that granted the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets are internet-connected digital storage units that hold user private keys.
Changpeng Zhao, who founded Binance in 2017, posted on X that user funds are safe. Although he stepped down as CEO in 2023 after pleading guilty to a felony related to money laundering controls, he remains a shareholder. Zhao said he expects all user funds to be fully covered. The U.S. President Donald Trump pardoned Zhao in 2025.
North Korea has increasingly used cryptocurrency hacking to generate foreign currency for its economy and nuclear program. In December 2022, South Korea’s spy agency reported that North Korean hackers had stolen an estimated $1.1 billion in digital assets over five years, with more than half of that amount taken in 2022. The agency assessed that North Korea’s capacity to steal digital assets is among the best in the world.
