$6.36B leaves Binance wallets in 20 minutes; investigators point to North Korea
Two blockchain firms say a North Korean hacking unit pulled funds across ten chains, while Binance freezes about $3 billion and prepares to resume withdrawals.
By Adriana Abebe ·
Roughly $6.36 billion moved out of Binance wallets across ten blockchains in about 20 minutes, according to blockchain intelligence firm TRM, which said Thursday the theft would be the largest cryptocurrency heist on record. TRM attributed the attack to TraderTraitor, which it describes as North Korea's elite hacking unit, and said it made that judgment with high confidence.
Binance, the world's largest cryptocurrency exchange, said it worked with blockchain partners to freeze about $3 billion in affected assets and began returning assets to users on Friday. Deposits continued to operate normally, the company said, while withdrawals were suspended and were expected to resume within a day or two. The exchange said it would cover all losses.
Chainalysis reached a similar conclusion about who was behind the theft. Chainalysis co-founder and CEO Jonathan Levin wrote on X that the Binance incident was likely done by DPRK group TraderTraitor. DPRK stands for the Democratic People's Republic of Korea, North Korea's official name.
TRM said several features of the Binance attack match earlier North Korea-linked heists, including the February 2025 hack of the exchange Bybit that took $1.5 billion. The FBI later said North Korea and TraderTraitor were responsible for the Bybit theft. Asked about the possible North Korea connection, a Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.
Binance said on X that its initial inquiry suggested a compromised laptop may have been involved, but a later investigation found additional points of breach. The company said it found no evidence that a wallet private key leaked and that it would release more technical details when the probe is finished.
Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, said the incident raises questions about why stronger approval controls were not in place. "This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," Gan said. Hot wallets hold the private keys, or digital authorizations, for users and stay connected to the internet.
Changpeng Zhao, who founded Binance in 2017, posted on X on Thursday that "User funds are safe!" while adding that the theft "does look like a hack on Binance." Zhao stepped down as CEO in 2023 after pleading guilty to a felony connected to failing to prevent money laundering on the platform, and President Donald Trump pardoned him in 2025. Zhao wrote that he no longer runs Binance but, "as a shareholder, I expect all user funds will be fully covered."
North Korea has leaned on crypto theft and other illicit cyber work for foreign currency to support its economy and nuclear program under U.N. sanctions, according to experts. In December 2022, South Korea's spy agency said North Korean hackers had stolen an estimated 1.5 trillion won, or about $1.1 billion, in cryptocurrency and other virtual assets over the prior five years, with more than half of that taken in 2022 alone. The agency said North Korea's ability to steal digital assets ranked among the best in the world.
