$6.3 billion Binance hack likely work of North Korea, experts say

A cyberattack stole roughly $6.3 billion from Binance, the world’s biggest cryptocurrency exchange. The incident mattered because analysts called it the largest cryptocurrency theft on record. Binance said customer deposits were unaffected, but withdrawals were suspended during the response.

The attacker moved approximately $6.36 billion from Binance wallets on ten blockchains, with most transfers occurring in about 20 minutes. Binance worked with blockchain partners to freeze roughly $3 billion in affected assets. The company said an initial investigation involved a compromised laptop, while a later probe found additional points of breach.

Binance expected withdrawals to resume within a day or two. It also promised to cover all customer losses. Its teams were working with law enforcement to identify the criminals. Binance later said it had found no evidence that wallet private keys had leaked, and promised more technical details after the investigation.

The Binance theft was enormous by cryptocurrency standards. TRM Labs said the attacker moved approximately $6.36 billion from Binance wallets across ten blockchains. Most of the money moved in about 20 minutes. Crypto industry analysts called the incident the largest cyber heist ever, while TRM called it the largest cryptocurrency theft on record.

The comparison with Bybit shows the scale clearly. In 2025, TraderTraitor targeted Bybit in an attack that caused a $1.5 billion loss, according to the FBI. The Binance theft was about $4.86 billion larger, or more than four times the Bybit loss. TRM said several features matched the earlier Bybit attack.

The figures remain tied to the investigation’s findings. Binance worked with blockchain partners to freeze roughly $3 billion in affected assets. The exchange said it would cover customer losses, while withdrawals were expected to resume after the security response.

TraderTraitor is the name TRM Labs gave to an elite North Korean hacking unit. The firm attributed the Binance attack to the group with high confidence. The identification matters because it links the world’s largest reported cryptocurrency theft to a broader pattern of cyberattacks associated with North Korea.

TRM pointed to several matching features. It said the attacker moved about $6.36 billion across ten blockchains, mostly within 20 minutes. The firm compared the operation with TraderTraitor’s 2025 attack on Bybit, which caused a $1.5 billion loss according to the FBI. Chainalysis CEO Jonathan Levin also called the Binance attack likely TraderTraitor’s work.

The conclusion is an assessment, not a final court finding. Analysts believe TraderTraitor members belong to the wider Lazarus Group. Binance said it was working with law enforcement to confirm the criminals’ identities. Its investigation continued, and the company said more technical details would follow.

Lazarus Group is described by analysts as a broad North Korean hacking unit. It targets institutions across government, finance, and other fields. TraderTraitor is believed to be part of this wider group. The U.S. Treasury Department has linked Lazarus Group to attacks, while the Justice Department alleged it was responsible for the 2014 Sony Pictures attack.

North Korea’s cybercrime reportedly serves an economic purpose. Experts say the country turned to cryptocurrency theft and other illicit cyber activities to obtain badly needed foreign currency. They connect that money to support for its troubled economy and nuclear program, especially after tough U.N. sanctions and other difficulties.

The scale of the activity is substantial. South Korea’s spy agency estimated that North Korean hackers stole 1.5 trillion won, or $1.1 billion, in cryptocurrency and other virtual assets over five years. More than half was stolen in 2022 alone. The agency said North Korea’s digital-asset theft capacity ranked among the world’s best.

Freezing stolen assets limits the attacker’s ability to move or cash out the money. Suspending withdrawals gives Binance time to investigate, secure its systems, and coordinate with law enforcement. Deposits were unaffected, so customers could still place funds into the exchange even while withdrawals were paused.

Binance worked with blockchain partners to freeze roughly $3 billion in affected assets. It expected withdrawals to resume within a day or two. The company also said it would cover all customer losses, meaning users were not expected to bear the financial impact of the theft.

The exchange still faced a major security investigation. Binance said its initial inquiry pointed to a compromised laptop, then found additional points of breach. It said there was no evidence of a wallet private-key leak. Teams were working around the clock, and Binance planned to release more technical details after the probe.

A hot wallet is a cryptocurrency wallet connected to the internet. A private key is the unique digital authorization used to control funds in that wallet. An access token is a digital credential that permits a system or wallet operation. These components make rapid transactions possible, but online access also creates security risks.

Cybersecurity executive Kok Tin Gan said the attack looked like one signature gave the attacker a never-expiring, full-access token to a Binance hot wallet. In this context, a signature is an approval proving that an authorized action was requested. If one approval can grant unlimited access, an attacker who obtains it may move funds without additional checks.

That explanation came from an expert, not Binance’s final conclusion. Binance said it found no evidence that wallet private keys leaked. The incident raised questions about stronger approval controls, and Binance said it would provide more technical details when its investigation was complete.

Blockchain technology records cryptocurrency transfers on digital ledgers maintained by networks of computers. Ownership is represented by control of a private key, while transactions create a history showing funds moving from one wallet address to another. This makes the movement of many stolen assets visible, even when the people behind addresses are not immediately identified.

In the Binance case, TRM Labs tracked an attacker moving approximately $6.36 billion from wallets across ten blockchains. Most transfers happened in about 20 minutes. Blockchain partners also helped freeze roughly $3 billion in affected assets. These actions show how transaction records can support investigations and intervention after a theft.

The article does not explain blockchain technology in detail; this description uses established general knowledge. In the case itself, Binance was still investigating the breach and working with law enforcement. The company said it had found no evidence of a private-key leak and would publish more technical information later.