Trump withholds blame on North Korea after $6.3 billion Binance hack

President Donald Trump declined to confirm North Korea's role in the largest cryptocurrency theft in history, a breach that drained more than $6.3 billion from Binance. The attack represents the biggest loss of digital assets ever recorded, according to blockchain intelligence firms. During a press interaction in the Oval Office, Trump stated that U.S. authorities are still analyzing the incident.

"We don't know. We are analyzing the situation," Trump told reporters. His cautious response contrasts with the preliminary findings of major tracking companies. TRM Labs, a U.S. blockchain intelligence firm, attributed the attack to a group called TraderTraitor. The company said it has a high degree of certainty in that attribution.

TraderTraitor has been linked to North Korea in previous cyber operations. According to TRM Labs, an attacker stole approximately $6.36 billion from wallets linked to Binance across 10 blockchains. The majority of the funds were withdrawn within a 20-minute window. Chainalysis, another leading blockchain analytics firm, also believes the same group executed the attack. Jonathan Levin, co-founder and CEO of Chainalysis, publicly supported that hypothesis.

Binance has not publicly identified the perpetrators. A company spokesperson said the platform is working with authorities and partners to determine who is responsible. Binance stated it has over $6.34 billion in reserves to cover the stolen assets. The company said it began recovery efforts immediately and froze approximately $3 billion in related assets in coordination with other industry firms.

Richard Teng, co-CEO of Binance, said the company's technology and security teams are investigating the incident. "We are working tirelessly to resolve this," Teng said in a video posted on X. Binance investigators initially found that the attack may have started with a compromised laptop. They later identified other vulnerabilities that expanded the scope of the investigation.

Teng confirmed that one of Binance's hot wallets was affected. Hot wallets remain connected to the internet to facilitate user withdrawals, while the majority of assets are stored in cold wallets that are offline. Teng said the attack does not appear to have been carried out by a single individual. He noted that the attackers used sophisticated techniques, including a self-destruction mechanism designed to hinder forensic analysis.

Binance assured customers that deposits were not affected. Withdrawals were temporarily suspended, with the company expecting to resume them within one to two days. Experts warn that thieves may attempt to move the remaining unfrozen funds through mixers or other services to obscure their origin. This attack follows a similar $1.5 billion breach at Bybit in February 2025, which the FBI attributed to North Korea and TraderTraitor.

North Korea has long used cyber operations to generate foreign currency and evade international sanctions. Funds from cryptocurrency thefts have been linked to the financing of the state's nuclear program. In December 2022, South Korea's intelligence agency estimated that North Korean hackers had stolen about $1.1 billion in digital assets over the previous five years. The current Binance theft exceeds that total by a wide margin.