North Korean Hackers Steal $6.3 Billion From Binance in Largest Crypto Heist Ever

6.36 billion dollars moved out of Binance wallets in roughly twenty minutes on October 28, according to blockchain intelligence firm TRM. The firm stated that an attacker executed the transfer across ten different blockchains. This figure would make the incident the largest cryptocurrency theft on record.

Binance, the world's largest cryptocurrency exchange, confirmed the breach on Friday. The company said it worked with blockchain partners to freeze approximately three billion dollars of the affected assets. It announced that it has begun the process of recovering assets for users. Binance stated that deposits were unaffected by the security failure. Withdrawals have been suspended and are expected to resume within the next two days. The exchange pledged that it will cover all losses incurred by users.

TRM attributed the attack to a North Korean hacking unit known as TraderTraitor. The firm described the group as an elite unit and expressed high confidence in its assessment. Chainalysis, another major blockchain analysis company, reached a similar conclusion. Jonathan Levin, the co-founder and CEO of Chainalysis, wrote on the social platform X that the hack was likely done by the DPRK group TraderTraitor. The DPRK is the official name for North Korea.

Binance said an initial investigation suggested a compromised laptop was involved in the incident. A subsequent review uncovered additional points of breach. The company stated on X that it found no evidence of any wallet private key leak. It promised to release more technical details once its internal probe is complete.

Changpeng Zhao, who founded Binance in 2017, commented on the event on X. Zhao posted that user funds are safe but noted that the theft looks like a hack on Binance. He said that as a shareholder, he expects all user funds to be fully covered. Zhao pleaded guilty to a felony in 2023 related to money laundering on the platform and stepped down as CEO. President Donald Trump pardoned Zhao in 2025.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the attack raises questions about approval controls. He noted that the incident appears to involve a single signature that granted the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets are digital storage systems connected to the internet that hold private keys.

A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals. Experts say North Korea has turned to crypto hacking to generate foreign currency for its economy and nuclear program. This activity has increased following tough United Nations sanctions. In December 2022, South Korea's spy agency estimated that North Korean hackers stole 1.5 trillion won, or 1.1 billion dollars, in virtual assets over five years.

In February 2025, the exchange Bybit suffered a 1.5 billion dollar hit from a hack. The FBI said North Korea and TraderTraitor were responsible for that incident. TRM noted that several features of the current Binance attack match earlier North Korea-linked heists, including the Bybit hack.