North Korean hackers blamed for record $6.3 billion crypto theft from Binance
Security researchers blame North Korean hackers for the largest known cryptocurrency theft in history, with at least $6.3 billion taken from the Binance exchange. About half of the sum has reportedly been frozen, and the investigation is ongoing.
Hackers working for the North Korean regime are being blamed for a record cryptocurrency theft from Binance, the world's largest crypto exchange. According to security researchers, at least $6.3 billion was taken from the company's wallets. Roughly half of that amount has been frozen as the stolen funds moved across various blockchains. It is the largest known crypto theft in history, but the incident is not yet confirmed as resolved, and the stolen total may change.
What Binance says
In a post on X, Binance said its initial investigation indicates the attackers got into the company's network by targeting a "compromised" laptop belonging to a Binance engineer. That allowed the attacker to reach a service container and submit unauthorized withdrawal transactions. The exchange says it has seen no evidence that its private keys leaked; such keys would give a hacker near-unfettered control over the company's crypto holdings.
Binance has suspended all deposits and withdrawals while the investigation continues. It stated that "user funds are safe" but did not immediately offer proof, and promised to publish an updated proof of reserves once remediation is complete. Company spokespeople did not respond to requests for comment.
Who is behind the attack
TRM Labs, a blockchain intelligence and forensics firm, attributes the breach to North Korean hackers known in the cybersecurity industry as TraderTraitor. Researchers describe the group as a North Korean cell focused almost exclusively on stealing crypto from large companies and exchanges. The same group was blamed for the second-largest theft on record, a $1.4 billion heist from the Bybit exchange in 2025. According to TRM, the theft from Binance took about 20 minutes.
Blockchain security firm Elliptic also attributes the theft to North Korea. It reports that some of the stolen funds ended up in the same wallet used in an earlier attack on the Bitget exchange this year, in which $351 million was stolen.
The U.S. government and its allies have long warned about the North Korean threat. The country remains cut off from the U.S. and the global financial system because of its nuclear weapons program, and researchers say it steals crypto to fund the continued development of sanctioned weapons of mass destruction.
It is unclear how the employee's laptop was compromised. Such incidents often stem from compromised software on employee devices.
