North Korean hackers blamed for stealing record $6.3B in Binance breach

The Binance breach involved attackers entering the exchange’s network and moving cryptocurrency out through unauthorized withdrawals. It matters because at least $6.3 billion was taken, making it the largest known cryptocurrency theft. Binance said it saw no evidence that private keys were leaked.

The attackers reportedly targeted a Binance engineer’s laptop. The compromised device allowed them to access a service container, an isolated software environment used by the company. From there, they submitted withdrawal transactions that Binance had not approved. The article does not explain how the laptop was compromised.

Binance suspended deposits and withdrawals while investigating. Industry partners froze about $3 billion, and Binance said it was working with law enforcement, issuers, blockchain intelligence firms, and other partners. The final amount stolen and the outcome of the recovery effort could still change.

A cryptocurrency exchange is a service where users can deposit, trade, store, and withdraw digital assets. Binance plays this role at enormous scale. The article calls it the world’s largest exchange and says it holds cryptocurrency in company wallets used to process users’ funds.

When users deposit crypto, the exchange receives assets through blockchain transactions and records the balances associated with customer accounts. When users withdraw, the exchange sends crypto from its wallets to an address chosen by the user. This makes exchange systems important targets because one compromised system can potentially affect many wallets and transactions.

Binance suspended deposits and withdrawals after the breach. It said user funds were safe, but had not immediately provided proof. The company said it would publish an updated proof of reserves after remediation, while continuing efforts to trace, freeze, and recover affected assets.

The reported theft reached at least $6.3 billion in cryptocurrency. About half of that amount was frozen as the assets moved across different blockchains. Binance spokesperson Andie Cooper later said industry partners had frozen about $3 billion, although the final stolen amount could still change.

The scale is extraordinary because researchers called it the largest known cryptocurrency theft in history. TRM Labs said the theft took about 20 minutes. The stolen funds also included assets that later reached a wallet used in an earlier Bitget attack, which involved $351 million.

The comparison may change because the Binance incident had not been confirmed as resolved. The article identifies the $1.4 billion Bybit theft in 2025 as the previous second-largest heist. Binance said it had begun recovering affected assets and was working with partners to freeze and recover more funds.

When Binance suspends deposits and withdrawals, users cannot normally send cryptocurrency into or out of the exchange. Trading and access to funds may be disrupted while investigators examine the breach. Binance said the suspension covered all deposits and withdrawals as its investigation continued.

Freezing stolen crypto can limit what attackers do with it. Industry partners may identify suspicious assets as they travel across blockchains and prevent those assets from being moved or redeemed through cooperating services. In this case, Binance said about $3 billion had been frozen, and that it had begun recovering affected assets for users.

The suspension also gives Binance time to investigate without continuing ordinary transfers. The company said it was working with law enforcement, issuers, blockchain intelligence firms, and industry partners. Users still face uncertainty because Binance had not immediately provided proof that user funds were safe.

TraderTraitor is the cybersecurity name for a North Korean cell that researchers describe as focusing almost exclusively on stealing cryptocurrency. TRM Labs and Elliptic both attributed the Binance theft to North Korean hackers. The attribution remains a researcher assessment rather than a statement that the attackers were publicly identified.

Researchers connect the group to other major thefts. TraderTraitor was also blamed for the $1.4 billion theft from crypto exchange Bybit in 2025. Elliptic said some Binance funds reached a wallet used in a previous Bitget attack, where hackers stole $351 million.

The article says North Korea has long been warned about by the United States and its allies. Researchers say the country steals as much cryptocurrency as possible to continue developing its sanctioned weapons of mass destruction. North Korea remains cut off from the U.S. and global financial system over its nuclear weapons program.

Employee laptops often connect to internal tools, software, and accounts needed for daily work. If a laptop is compromised, attackers may steal passwords or session tokens and act as though they are a legitimate employee. The Binance incident raises a major question: why could one laptop reach systems capable of controlling billions of dollars?

The article describes several possible routes. Compromised software components can steal data from devices where they are installed. Malware hidden in ordinary-looking apps or games can also capture usernames, passwords, and session tokens. Binance said the laptop compromise allowed access to a service container and unauthorized withdrawal transactions.

A standard security principle called least privilege is designed to limit this risk. It means each employee, device, or service should receive only the access required for its task. Strong separation, extra approvals, and independent checks can reduce the damage when one device is compromised. The article says it is unclear whether Binance had a prior security review.

A blockchain is a shared digital record that stores transactions across a network. A crypto wallet is software or infrastructure that lets someone receive, hold, and send digital assets. A private key is secret authorization that can control funds associated with a wallet. Binance said it saw no evidence that its private keys had leaked, because that could give an attacker near-unfettered control.

Crypto transactions move between wallet addresses on particular blockchains. Investigators examine those records, connect addresses to known services, and watch where assets go. In the Binance case, researchers tracked funds across various blockchains and identified a wallet also used in an earlier Bitget attack.

This tracing does not require a traditional bank to record every transfer. Blockchain intelligence firms and industry partners can monitor movements and cooperate with exchanges, issuers, and law enforcement. They may freeze assets when they reach cooperating services. However, the article does not explain every technical limit of tracing or recovery.