$6.3 billion Binance hack was likely work of North Korea, blockchain intel firms say
A U.S.-based blockchain intelligence firm said a North Korean cyber unit was likely behind an attack that stole $6.3 billion from Binance, the world's biggest cryptocurrency exchange.
Binance said on Friday that deposits were unaffected, while withdrawals were suspended and are expected to resume in the next day or two. The company, which worked with blockchain partners to freeze roughly $3 billion in affected assets, also said it will cover all customer losses.
In a social media post, Binance said that an initial investigation suggested the incident may have involved a compromised laptop, while a subsequent probe uncovered additional "points of breach."
Crypto industry analysts say the hack against Binance is the largest cyber heist ever.
What is TraderTraitor?
In a post on its website Thursday, tech security firm TRM Labs attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit. "We make this judgment with high confidence," TRM said.
"An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," the firm said. That would make the hack the largest cryptocurrency theft on record, it said.
In 2025, TraderTraitor also targeted another crypto exchange, Bybit, in an attack resulting in a $1.5 billion loss, according to the FBI.
"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack," TRM said.
Jonathan Levin, co-founder and CEO of blockchain research firm Chainalysis, also said on social media that the Binance hack was "likely done" by TraderTraitor.
Analysts believe that TraderTraitor members are part of a wider North Korean hacking unit known as Lazarus Group, which targets multiple institutions across government, finance and other fields, according to the U.S. Treasury Department.
The Justice Department alleged in 2018 that the Lazarus Group was responsible for an attack on Sony Pictures Entertainment four years earlier that leaked a massive amount of sensitive company data online.
Working "around the clock"
Binance said on social media that its "teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice."
Experts say North Korea has turned to crypto hacking and other illicit cyber activities as a source of badly needed foreign currency to support its troubled economy and fund its nuclear program in the wake of tough U.N. sanctions and other difficulties.
In December 2022, South Korea's spy agency said North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in cryptocurrency and other virtual assets in the past five years, more than half of it in 2022 alone. It said North Korea's capacity to steal digital assets was considered among the best in the world.
Changpeng Zhao, also known as CZ, founded Binance in 2017. In 2023, he pleaded guilty to a felony linked to failing to prevent money laundering on the platform and stepped down as the company's CEO. President Trump pardoned Zhao in 2025.
Zhao posted Thursday on social media that "User funds are safe!" but added that the theft "does look like a hack on Binance." He added that, while he no longer manages Binance, "As a shareholder, I expect all user funds will be fully covered."
The event, meanwhile, also raises questions about why stronger approval controls were not in place, said Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab.
"This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said, referring to cryptocurrency wallets that hold users' "private keys," or unique authorizations, digitally and which are connected to the internet.
Binance said on social media it had "found no evidence of any wallet private key leak" and that the company would release more technical details when its probe is complete.
