Crypto Security: North Korea Linked to $6.3B Binance Heist

The cryptocurrency market faces its most severe security breach to date after analysts connected a massive drain of digital assets to a state-sponsored group from the Korean Peninsula. The incident marks a new benchmark for the size of stolen funds in the crypto industry.

U.S.-based blockchain intelligence firm TRM identified the perpetrators as TraderTraitor, a unit it describes as North Korea’s elite hacking group. TRM stated it made this attribution with high confidence, noting that several technical features of the attack matched previous North Korea-linked heists. The firm specified that the attacker moved approximately $6.36 billion out of Binance wallets across ten different blockchains. Most of this movement occurred within a twenty-minute window.

This theft surpasses the previous record set in February 2025, when the exchange Bybit suffered a $1.5 billion loss. The FBI attributed the Bybit hack to the same North Korean group, TraderTraitor. Chainalysis, another major blockchain analysis company, reached a similar conclusion. CEO Jonathan Levin wrote on X that the attack was likely executed by the DPRK group TraderTraitor. The acronym DPRK refers to the Democratic People’s Republic of Korea, the official name for North Korea.

Binance, the world’s largest cryptocurrency exchange, responded to the breach by freezing roughly $3 billion in affected assets. The company said it worked with blockchain partners to secure these funds. Binance announced on Friday that deposits were unaffected by the incident. However, withdrawals have been suspended and are expected to resume within the next day or two. The exchange confirmed it will cover all losses incurred by users.

Initial investigations into the breach suggested a compromised laptop may have been the entry point. Subsequent inquiries revealed additional points of breach. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, noted that the attack appeared to rely on a single signature. This signature granted the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold private keys digitally and are connected to the internet, making them more vulnerable than offline storage.

Binance stated it found no evidence that any wallet private keys leaked during the event. The company plans to release more technical details once its internal probe is complete. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice. The exchange did not officially confirm the North Korean link in its initial statements.

Changpeng Zhao, also known as CZ, who founded Binance in 2017, commented on the situation despite no longer managing the company. Zhao pleaded guilty to a felony in 2023 related to failing to prevent money laundering and stepped down as CEO. U.S. President Donald Trump pardoned Zhao in 2025. Zhao posted on X that user funds are safe and that the event looks like a hack on Binance. As a shareholder, he said he expects all user funds to be fully covered.

North Korea has increasingly relied on crypto hacking to generate foreign currency. The revenue helps support its troubled economy and funds its nuclear program, especially after tough United Nations sanctions. In December 2022, South Korea’s spy agency reported that North Korean hackers stole an estimated $1.1 billion in cryptocurrency and other virtual assets over the previous five years. More than half of that total was stolen in 2022 alone. The agency considered North Korea’s capacity to steal digital assets to be among the best in the world.