(2nd LD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm

Stealing cryptocurrency from an exchange means taking digital assets without the exchange’s permission. An exchange such as Binance holds or controls systems that authorize transfers for customers. If attackers enter those systems, they can direct assets to wallets they control. This is different from a customer simply losing access to a personal wallet.

According to TRM Labs, the hackers gained access to systems used to authorize cryptocurrency transfers. They then moved assets across 10 blockchain networks. Most of the reported funds were taken in about 20 minutes, after at least 36 hours of preparation. Binance co-CEO Richard Teng said the company would cover hacked losses through company funds.

The alleged theft matters because exchanges hold large amounts of customer assets in one place. TRM Labs said about $2.7 billion was frozen, while roughly $2.4 billion remained under hacker control. The case shows why exchange security, rapid cooperation, and tracking blockchain transactions are important after a breach.

TRM Labs estimated that the Binance attack involved US$6.36 billion in stolen cryptocurrency. If confirmed, it would be the largest cryptocurrency theft on record. The size matters because a single incident could affect assets spread across many blockchain networks and require an unusually large response from the exchange and other companies.

The reported amount is more than four times the US$1.5 billion stolen from cryptocurrency exchange Bybit in February 2025. The U.S. Federal Bureau of Investigation attributed that earlier theft to TraderTraitor. TRM Labs said the Binance attack was also most likely carried out by that North Korean hacking group.

The figures describe the estimated theft, not necessarily the amount that remains freely usable. TRM Labs said about $2.7 billion had been frozen through cooperation among companies and blockchain operators. It said hackers still controlled roughly $2.4 billion in Bitcoin and Ethereum. Binance said it had reserved over $6.34 billion to cover stolen assets.

The reported access point was not described as a simple theft from one customer wallet. TRM Labs said the hackers prepared for at least 36 hours and gained access to systems used to authorize cryptocurrency transfers. Those systems are important because approval there can allow assets to leave exchange-controlled accounts.

Once inside, the attackers allegedly moved digital assets without permission across 10 blockchain networks. Most of the funds were taken in about 20 minutes. The article does not specify the exact technical vulnerability, such as a stolen password, malware, or compromised signing device. It only states that authorization systems were accessed.

That distinction matters when investigators assess the damage. They must identify which transfers were approved, where the assets went, and which companies can freeze them. TRM Labs said cooperation froze about $2.7 billion. The remaining funds could be moved again, making rapid monitoring and coordination necessary.

TraderTraitor is identified in the article as a North Korean hacking group. The group is associated with major cryptocurrency thefts, including the US$1.5 billion Bybit theft in February 2025, which the FBI attributed to TraderTraitor. North Korea has previously been linked by U.S. officials to networks that launder stolen digital assets.

TRM Labs said it had “high confidence” that TraderTraitor carried out the Binance attack. Its conclusion came from analyzing cryptocurrency transactions and comparing the activity with earlier North Korean hacking operations. The firm said the attack was most likely conducted by the group, rather than presenting the attribution as a court-proven fact.

The attribution matters because stolen cryptocurrency can support wider procurement and weapons programs, according to U.S. officials. The article says North Korea uses nationals abroad and foreign-based facilitators in several countries to convert digital assets into fiat currency. The FBI said it was coordinating with partners to assess the incident and investigative steps.

Freezing stolen cryptocurrency means cooperating companies or blockchain operators prevent identified assets from being moved or exchanged through services they control. A freeze does not necessarily erase the transaction or return funds immediately. It preserves a chance for investigators and the exchange to identify, secure, and potentially recover the assets.

TRM Labs said about $2.7 billion in stolen assets had been frozen through cooperation among cryptocurrency companies and blockchain operators. It also said hackers still controlled roughly $2.4 billion worth of Bitcoin and Ethereum. Those figures show how joint action can limit a theft while leaving a large amount exposed.

TRM Labs warned that hackers might move the remaining funds between blockchain networks and cryptocurrency trading platforms. The firm said this could help hide the origins of the money. Moving funds does not necessarily remove the transaction history, but it can create more steps for investigators and more organizations that must recognize and restrict the assets.

Binance can cover customer losses directly from company funds, even while investigators and partners work on the stolen assets. This approach separates customer reimbursement from the slower process of tracking, freezing, and potentially recovering cryptocurrency. It can protect customers from bearing the immediate financial loss if the company honors its commitment.

Richard Teng, Binance’s co-CEO, said the company would cover all hacked losses through its company funds. He added that Binance had reserved over $6.34 billion for that purpose, including $5 billion already held in the exact token assets affected. Separately, cryptocurrency companies and blockchain operators had frozen about $2.7 billion.

The two responses work differently. Binance’s reserves can provide compensation, while cooperation may restrict stolen coins and support recovery efforts. The article does not say that all frozen assets have been returned. It also reports that hackers still controlled roughly $2.4 billion, so tracing and containment remained ongoing.

A blockchain records cryptocurrency transactions in a shared digital ledger. Each transfer typically identifies sending and receiving wallet addresses, the amount, and the transaction time. The record is designed to remain available and difficult to alter. Wallet addresses are not automatically real-world names, so investigators often need additional evidence to connect activity to people or companies.

That structure makes stolen funds traceable. Analysts can follow transfers from an exchange to new wallets and across networks. In this case, TRM Labs used transaction analysis to assess the attack and said companies and blockchain operators froze about $2.7 billion. The article also says hackers could move funds between networks and trading platforms to hide their origins.

Traceability does not guarantee recovery. A visible transfer cannot by itself force a recipient to return funds. Recovery may require a service to freeze assets, an exchange to reject deposits, or authorities to take investigative steps. The article says roughly $2.4 billion remained under hacker control, showing why tracking and cooperation must continue.