Binance Hack: $6.3 Billion Stolen in Largest Crypto Theft on Record

Binance users face temporary restrictions on moving funds after an attacker drained $6.36 billion from the exchange. The world's largest cryptocurrency platform has suspended withdrawals, which are expected to resume within the next day or two. Deposits remain open, and the company stated it will cover all losses associated with the incident.

Blockchain intelligence firm TRM attributed the theft to TraderTraitor, an elite North Korean hacking unit. The firm expressed high confidence in this judgment. An attacker moved the funds out of Binance wallets across ten blockchains, with the majority of the transfer completed in approximately 20 minutes. This amount makes the event the largest cryptocurrency theft on record.

Binance disclosed that an initial investigation pointed to a compromised laptop as the entry point. However, subsequent reviews identified additional points of breach. The company announced on Friday that it began recovering assets for users, having frozen roughly $3 billion in affected holdings with the help of blockchain partners.

Chainalysis co-founder Jonathan Levin agreed with the attribution, writing that the hack was likely executed by the DPRK group TraderTraitor. A Binance spokesperson noted that the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

The attack shares features with previous North Korea-linked heists, including the February 2025 breach of Bybit. That incident resulted in a $1.5 billion loss, which the FBI attributed to the same North Korean unit. Experts note that North Korea relies on crypto hacking to generate foreign currency for its economy and nuclear program amidst strict U.N. sanctions.

Changpeng Zhao, the founder of Binance, posted on X that user funds are safe. He described the event as a hack on Binance and stated that, as a shareholder, he expects all user funds to be fully covered. Zhao pleaded guilty to a money laundering felony in 2023 and stepped down as CEO, receiving a presidential pardon in 2025.

Cybersecurity experts raised questions about the approval controls in place at the time of the breach. Kok Tin Gan, CEO of NyxLab, suggested the attacker obtained a never-expiring, full-access token to a hot wallet. Binance countered this by stating it found no evidence of a wallet private key leak. The company plans to release more technical details once its probe is complete.