Binance freezes $3 billion after $6.36 billion crypto heist linked to North Korea

Binance, the world's largest cryptocurrency exchange, has suspended withdrawals for its users following a hack that stole approximately $6.36 billion. The company stated on Friday that deposits remain unaffected and that it will cover all losses incurred by customers. Withdrawals are expected to resume within one to two days.

The theft marks the largest cryptocurrency heist on record. TRM Labs, a U.S.-based blockchain intelligence firm, assessed with high confidence that the North Korean hacking unit TraderTraitor was behind the attack. The firm noted that an attacker moved the funds from Binance wallets across ten blockchains, with the majority of the transaction volume occurring in a 20-minute window.

Binance announced that it worked with blockchain partners to freeze nearly $3 billion of the affected assets. In an initial investigation, the company found that a compromised personal computer may have played a role in the incident. However, subsequent reviews identified additional vulnerability points within the system.

Chainalysis, another blockchain analysis firm, also attributed the hack to TraderTraitor. Jonathan Levin, the company's co-founder and CEO, wrote on X that the attack was likely carried out by the group from the Democratic People's Republic of Korea. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

The attack shares several characteristics with previous thefts linked to North Korea, including the $1.5 billion hack of the exchange Bybit in February 2025. The FBI previously attributed that incident to North Korea and TraderTraitor. South Korean intelligence agencies reported in December 2022 that North Korean hackers stole an estimated $1.1 billion in crypto assets over the preceding five years, with more than half of that amount taken in 2022 alone.

Experts say North Korea relies on illicit cyber activities and crypto theft to generate foreign currency. These funds are used to support its economy and finance its nuclear program amid heavy United Nations sanctions. The ability of North Korean hackers to extract digital assets is considered among the best in the world.

Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, raised questions about access controls at Binance. Gan stated that a single signature appeared to give the attacker a non-expiring token for full access to a hot wallet. Hot wallets store private keys connected to the internet, unlike cold storage which is offline.

Binance stated on X that it has not found evidence of leaked private keys from wallets. The company plans to publish more technical details once its investigation is complete. Changpeng Zhao, known as CZ, who founded Binance in 2017, said on X that user funds are safe. Although he is no longer the CEO, Zhao added that as a shareholder he expects all user funds to be fully covered.

Zhao pleaded guilty to a felony related to money laundering failures in 2023 and stepped down as CEO. President Donald Trump granted Zhao a pardon in 2025. The current incident follows a period of legal resolution for the founder, who continues to hold an equity stake in the exchange.