North Korean Hackers Suspected in Over $6 Billion Binance Crypto Theft
Analytics firms TRM Labs and Chainalysis believe the attack on the Binance cryptocurrency exchange may have been carried out by the North Korean group TraderTraitor, also known as Lazarus Group. Binance has pledged to reimburse customers for their losses.
More than $6 billion has been stolen from the cryptocurrency exchange Binance, and a North Korean hacking group known as TraderTraitor, or Lazarus Group, may be responsible. That is the assessment of analytics firms TRM Labs and Chainalysis, as reported by the BBC. Experts regard the incident as the largest cryptocurrency theft in history.
How the attackers got in
A preliminary review by Binance found that the attackers gained access to its system by hacking the laptop of one of its engineers. The exchange also discovered additional points of breach.
Possible link to Russia
The independent Russian investigative outlet Agentstvo notes that the group may have ties to Russia. A report published in March 2024 by a UN Security Council panel of experts said Lazarus Group is very active in the Russian Federation and retains access to Russian systems. In 2025, cybersecurity researchers found that the group had routed internet traffic through servers in the Russian village of Khasan, on the border with North Korea.
Compensation for customers
Binance announced that about half of the stolen funds have been frozen, although a significant portion remains in the hackers' hands. The exchange has pledged to reimburse customers for their losses and has set aside $6.34 billion of its own funds for that purpose. It says it has already begun returning assets.
The previous record
The earlier record belonged to the hack of the Bybit exchange in February 2025, when attackers stole about $1.5 billion. TraderTraitor was blamed for that attack as well.
