Binance Hack Exceeds Six Billion Dollars

Approximately $6.36 billion moved out of Binance wallets across ten blockchains in a span of about twenty minutes. The U.S.-based blockchain intelligence firm TRM identified the attacker as TraderTraitor, a North Korean hacking unit. The company stated it made this attribution with high confidence.

Binance, the world’s largest cryptocurrency exchange, confirmed the breach on Friday. The company worked with blockchain partners to freeze roughly $3 billion in affected assets. It has begun the process of recovering assets for users. Binance said deposits were unaffected during the incident. Withdrawals were suspended and are expected to resume within the next day or two. The exchange stated it will cover all losses.

The initial investigation suggested a compromised laptop may have been involved. A subsequent review uncovered additional points of breach. TRM noted that several features of the attack matched earlier North Korea-linked heists, including a $1.5 billion hack on the exchange Bybit in February 2025. The FBI previously attributed that Bybit breach to North Korea and TraderTraitor.

Chainalysis, another blockchain analysis company, reached a similar conclusion. Its co-founder and CEO, Jonathan Levin, wrote on X that the hack was likely done by the DPRK group TraderTraitor. The Democratic People's Republic of Korea is the official name of North Korea.

A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals. The firm stated it found no evidence of any wallet private key leak. It plans to release more technical details when its probe is complete.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the event raises questions about why stronger approval controls were not in place. Gan described the breach as a single signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys and are connected to the internet.

Changpeng Zhao, known as CZ, founded Binance in 2017. He pleaded guilty to a felony in 2023 related to failing to prevent money laundering and stepped down as CEO. U.S. President Donald Trump pardoned Zhao in 2025. Zhao posted on X on Thursday that user funds are safe. He added that the theft looks like a hack on Binance and that, as a shareholder, he expects all user funds to be fully covered.

Experts say North Korea has turned to crypto hacking as a source of foreign currency to support its economy and fund its nuclear program. In December 2022, South Korea's spy agency reported that North Korean hackers had stolen an estimated $1.1 billion in digital assets in the past five years. More than half of that total occurred in 2022.