More than $6 billion vanished from Binance, the world’s largest cryptocurrency exchange, in what analysts are calling the biggest crypto theft ever recorded. Now, U.S. blockchain intelligence experts are pointing the finger at a North Korean elite hacking unit — raising fresh questions about the security of digital assets held by millions of ordinary users.
Blockchain intelligence firm TRM published findings Thursday attributing the attack to a group known as TraderTraitor, which it identified as North Korea’s premier cyber-espionage and financial theft unit. The firm stated it makes the attribution “with high confidence,” citing technical hallmarks of the breach that closely resemble previous North Korean operations. Cybercrime analysts at blockchain research company Chainalysis reached the same conclusion, with co-founder and CEO Jonathan Levin writing on X that the Binance hack was “likely done by DPRK group TraderTraitor.”
According to TRM, the scale of the theft was staggering:
“An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes.”
The speed and scope of the movement set it apart from previous incidents and, if confirmed, would make it the largest single cryptocurrency theft in history.
What Binance Has Said
Binance confirmed it was working with blockchain partners to freeze roughly $3 billion in affected assets, and on Friday the company said it had begun returning funds to impacted users. The company stated that customer deposits were not affected, though withdrawals were temporarily suspended and expected to resume within a day or two. Binance has pledged to cover all losses stemming from the incident.
In posts on X, Binance said its initial investigation pointed to a compromised laptop as the likely entry point, but that further investigation uncovered additional “points of breach.” The company also said it had “found no evidence of any wallet private key leak” and promised to release full technical details once its internal probe is complete.
Changpeng Zhao — better known as CZ — founded Binance in 2017 but no longer runs the company. In 2023, he pleaded guilty to a felony related to failures to prevent money laundering on the platform and stepped down as CEO. He was later pardoned by President Donald Trump in 2025. Despite no longer managing day-to-day operations, Zhao weighed in on X, writing that “User funds are safe!” while acknowledging the theft “does look like a hack on Binance.” He added that while he doesn’t manage Binance anymore,
“as a shareholder, I expect all user funds will be fully covered.”
When asked about possible North Korean involvement, a Binance spokesperson declined to confirm the connection, saying only that the company is
“working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.”
Security Concerns Emerge
The incident has drawn scrutiny over internal security controls. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, raised pointed concerns about how the attacker was able to gain such sweeping access.
“This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,”
he said, referring to digital wallets connected to the internet that store users’ private keys — the unique authorizations that control access to cryptocurrency holdings. Gan said the breach raises questions about why stronger approval controls were not in place.
North Korea’s Growing Crypto Threat
This is not the first time North Korea has been linked to a major exchange hack. In February of last year, the exchange Bybit lost $1.5 billion after its systems were compromised — an attack the FBI also attributed to North Korea and the TraderTraitor group. TRM noted that “several features of this attack match earlier North Korea-linked heists, including the Bybit hack.”
Cybersecurity experts who follow developments across Asia say North Korea has made state-sponsored crypto theft a central pillar of its financial strategy. Faced with sweeping United Nations sanctions and a struggling domestic economy, the regime has relied heavily on illicit cyber operations to generate hard currency and bankroll its nuclear weapons program. South Korea’s national intelligence agency reported in December 2022 that North Korean hackers had stolen an estimated 1.5 trillion won — roughly $1.1 billion — in cryptocurrency and other virtual assets over the preceding five years, with more than half of that total taken in 2022 alone. The agency characterized North Korea’s capacity to steal digital assets as among the most sophisticated in the world.
Comments are closed.