North Korea denies being behind record $6.3bn Binance hack

The Binance hack involved unauthorised withdrawals from one of the world’s major cryptocurrency exchanges. The reported loss was $6.3bn (£4.7bn), making it the largest cryptocurrency theft described in the article. Its scale matters because such a breach can affect customers, market confidence, and the wider cryptocurrency industry.

Binance said initial checks showed that an engineer’s laptop had been compromised. That access enabled an attacker to make unauthorised withdrawals. Trading was suspended while Binance and cryptocurrency issuers worked to freeze affected assets. Binance later said customers withdrew more than $3.6bn as activity resumed.

The FBI, Secret Service, and blockchain analysts attributed the attack to North Korea-linked TraderTraitor, also known as the Lazarus Group. North Korea denied responsibility and called the claims “absurd rhetoric”. Binance has said it will cover all losses and had covered around 95% of the stolen assets.

The article reports that cryptocurrency worth $6.3bn (£4.7bn) was involved in the Binance hack. That figure is presented as the largest cryptocurrency theft in history. It measures the reported value of the assets stolen or affected in the breach, rather than the number of individual coins or customers involved.

The comparison is stark. TraderTraitor, also known as the Lazarus Group, was blamed for a then-record $1.5bn hack of the Bybit exchange in 2025. Dividing $6.3bn by $1.5bn gives roughly 4.2, so the reported Binance loss was more than four times the Bybit figure.

The financial scale helps explain the intense response. Binance suspended transactions, worked with issuers to freeze affected assets, and later resumed trading. Customers withdrew more than $3.6bn after reopening, while Binance said it had covered around 95% of the stolen assets.

A cryptocurrency exchange is a service that lets customers trade digital assets and manage their holdings. It matters because the exchange’s systems control access to large pools of cryptocurrency. A successful breach can therefore affect many customers at once, even if the customers’ own devices were never hacked.

In this case, Binance said an engineer’s laptop had been compromised. The article says that compromise enabled an attacker to make unauthorised withdrawals. A work device may provide access to internal tools, accounts, or approval processes used to move assets. The article does not specify exactly which control was abused.

Binance suspended transactions after the breach and worked with cryptocurrency issuers to freeze affected assets. Trading later resumed, but customers withdrew more than $3.6bn. Binance also said it would cover all losses linked to the attack and had covered around 95% of the stolen assets.

The FBI, the Secret Service, and blockchain analysts attributed the Binance attack to North Korea and the state-backed group TraderTraitor. The article also identifies TraderTraitor as the Lazarus Group. Their attribution matters because the United States has linked the group to a wider pattern of major cryptocurrency attacks and asked industry partners to block related transactions.

The article does not describe the specific technical evidence behind the attribution. It reports that blockchain analysts and the FBI said TraderTraitor led the attack. Blockchain analysis can identify connections between cryptocurrency accounts and previous activity, while investigators can compare attack methods and infrastructure. Those methods are the general basis for such attributions, not details confirmed here.

North Korea rejects the claims. Kim Yo-jong called them a “sinister attempt” to damage Pyongyang’s image. The article notes that TraderTraitor was also blamed for the $1.5bn Bybit hack in 2025, while North Korea has consistently denied cybercrime accusations.

When exchanges and cryptocurrency issuers freeze linked accounts or transactions, the stolen assets may become difficult or impossible to move through those services. This can limit an attacker’s ability to exchange, withdraw, or transfer the funds. Freezing does not necessarily mean the assets have been returned immediately; it mainly restricts access while investigators and companies respond.

After the Binance hack, the exchange worked with issuers to freeze assets affected by the breach. The FBI also called on industry partners to help block transactions involving cryptocurrency accounts linked to TraderTraitor. These actions target the accounts and transaction paths associated with the stolen funds.

Trading on Binance later resumed, but the consequences continued. Customers withdrew more than $3.6bn when the exchange reopened after suspending transactions. Binance said it would cover all losses connected to the attack and had so far covered around 95% of the assets stolen.

International sanctions can restrict a country’s ability to trade, access financial services, and earn money through ordinary channels. The article says North Korea has been accused of relying on cybercrime to help finance its sanctioned economy. That makes cryptocurrency theft significant beyond individual exchanges: investigators view it as a possible source of funds for a heavily restricted state.

The article describes a wider system behind these accusations. Research groups have said North Korea recruits promising university students and sends them to hacker units overseen by its intelligence agency. The TraderTraitor unit, also called the Lazarus Group, has been blamed for major cryptocurrency attacks, including the $1.5bn Bybit hack in 2025.

North Korea denies the allegations. Kim Yo-jong said linking every cybercrime to the DPRK was a political provocation. She also said the government opposed malicious acts in cyberspace. The article indicates that accusations and denials are likely to continue as investigations track cryptocurrency activity.

A blockchain records cryptocurrency transactions in a shared ledger maintained across a network. Each transfer is linked to previous records, creating a history of how assets move between wallet addresses. This matters because investigators can follow transactions publicly instead of relying only on private exchange records.

For example, analysts can watch funds move from an account connected with a hack into other addresses, exchanges, or services. The addresses are visible, but they are usually strings of letters and numbers rather than names. Investigators may connect an address to a person or organisation when it interacts with a regulated exchange or other identified service.

The article refers to blockchain analysts tracing accounts linked to TraderTraitor and says the FBI asked industry partners to block related transactions. It does not explain blockchain mechanics, so this background comes from established knowledge. Public tracing can reveal movement, but identifying the controller may remain difficult.