N. Korean hackers blamed for record $6.3b Binance cryptocurrency theft: US firm

An estimated $6.36 billion in cryptocurrency was stolen from Binance, the world’s largest cryptocurrency exchange. TRM Labs said the attack affected digital assets across 10 blockchain networks. The theft matters because it would be the largest cryptocurrency theft on record, far exceeding earlier major exchange hacks.

TRM Labs attributed the operation with high confidence to TraderTraitor, a hacking group linked to North Korea. Its conclusion came from studying cryptocurrency transactions and comparing the attack with previous North Korean hacking operations. The hackers reportedly prepared at least 36 hours before the attack and took most of the funds within about 20 minutes.

About $2.7 billion in assets had been frozen through cooperation between cryptocurrency companies and blockchain operators. Roughly $2.4 billion in Bitcoin and Ethereum remained under the hackers’ control. Binance said it would cover the losses using company funds, while the FBI coordinated with partners to assess the incident.

TRM Labs estimated that hackers stole $6.36 billion in cryptocurrency from Binance. That figure would make the incident the largest cryptocurrency theft ever recorded. The scale matters because a single attack affected assets spread across 10 blockchain networks and created major risks for exchanges, blockchain operators, and law enforcement.

The comparison is striking. The theft would far exceed the $1.5 billion stolen from the cryptocurrency exchange Bybit in February 2025. The US Federal Bureau of Investigation attributed that earlier attack to TraderTraitor, the same group TRM Labs connected to the Binance incident. Most of the Binance funds were reportedly taken in about 20 minutes.

The situation remained significant even after some assets were frozen. TRM Labs said companies and blockchain operators had frozen about $2.7 billion. However, hackers still controlled roughly $2.4 billion in Bitcoin and Ethereum, leaving a large amount at risk of movement or concealment.

Binance is the world’s largest cryptocurrency exchange, according to the article. A cryptocurrency exchange is a platform where users can buy, sell, and trade digital assets. It also helps manage the movement of those assets between accounts, wallets, and blockchain networks. That makes an exchange a central place for handling large volumes of cryptocurrency.

In this incident, hackers allegedly gained access to systems used to authorize cryptocurrency transfers. That access allowed them to move digital assets without permission. The stolen funds crossed 10 blockchain networks, showing how an exchange’s systems can connect activity involving many different digital currencies and transaction networks.

The attack highlights why exchanges matter beyond ordinary trading. They hold or control systems that can approve transfers, making them valuable targets. Binance said it was working to resolve the issue and would cover hacked losses through company funds. It also said more than $6.34 billion was reserved for that purpose.

TRM Labs believes the attackers gained access to systems used to authorize cryptocurrency transfers. These systems normally help approve the movement of digital assets. If attackers control them, they may be able to make unauthorized transfers appear valid. The article does not identify the exact technical weakness or explain how the attackers entered those systems.

The hackers began preparing at least 36 hours before the main operation. Once they had the necessary access, they moved most of the stolen funds in about 20 minutes. The attack covered assets across 10 blockchain networks, suggesting that the compromised authorization systems could direct many transactions quickly.

Speed makes a theft harder to contain. Cryptocurrency transfers can be initiated rapidly, and activity can spread across several networks before companies respond. Cooperation later froze about $2.7 billion in assets, but hackers still controlled roughly $2.4 billion in Bitcoin and Ethereum. Binance said it would use company funds to cover losses.

TRM Labs said it had high confidence that TraderTraitor carried out the Binance attack. Its assessment relied on analyzing cryptocurrency transactions and finding similarities with previous North Korean hacking operations. The FBI had also attributed the earlier $1.5 billion Bybit theft to TraderTraitor, strengthening the connection between the group and North Korea.

US officials say North Korea uses nationals abroad and foreign-based facilitators in China, Russia, Cambodia, and Vietnam. These networks can help launder stolen digital assets into fiat currency, meaning ordinary government-issued money. The article links that money to procurement activities and funding for North Korea’s weapons of mass destruction programs.

The Binance theft could therefore have consequences beyond the exchange and its customers. Hackers still controlled roughly $2.4 billion in Bitcoin and Ethereum after about $2.7 billion was frozen. TRM Labs warned that they might move the remaining funds across blockchains and trading platforms to hide their origins.

When companies freeze stolen cryptocurrency, they restrict the affected assets from being moved or used through cooperating platforms or blockchain systems. TRM Labs said cooperation among cryptocurrency companies and blockchain operators had frozen about $2.7 billion. Freezing can limit the hackers’ immediate ability to spend, exchange, or transfer those funds.

The freeze did not cover everything. Hackers still controlled roughly $2.4 billion worth of Bitcoin and Ethereum, two major cryptocurrencies. TRM Labs warned that they could try to hide the money’s origins by moving it between different blockchain networks and cryptocurrency trading platforms. Such movement can make recovery and attribution more difficult.

The remaining risk is therefore both financial and investigative. Assets may be dispersed across several services before companies identify and block them. The FBI said it was coordinating with partners to understand the activity, evaluate potential impacts, and plan investigative steps. Binance promised to cover hacked losses through company funds.

A blockchain records cryptocurrency transactions in a shared digital ledger maintained across a network. Each transaction is linked to earlier records, creating a transaction history that can be examined. This is why firms such as TRM Labs can analyze transaction flows after a theft and compare them with patterns from earlier operations.

Traceability does not mean instant control. Once a transfer is accepted by a blockchain, the network records it as part of its history. The article shows this tension: investigators could study the attackers’ movements, while companies and blockchain operators separately worked together to freeze assets. The hackers moved funds across 10 networks, complicating that response.

Transfers are therefore traceable without necessarily being easy to stop or reverse. Freezing usually depends on cooperation from exchanges, companies, or operators that can restrict access to assets they control. TRM Labs warned that moving funds across networks and trading platforms could hide their origins, even while transaction records remained available for analysis.