Science & Tech · Cybersecurity · 1 hr ago
Firms link Binance hack to North Korean hackers
Binance was hit by a major cryptocurrency hack that moved billions of dollars from its wallets.
Blockchain firms TRM and Chainalysis say North Korea’s TraderTraitor hacking unit was likely responsible, but investigations are still underway.
Estimates differ: TRM says about $6.36 billion was moved, while another account puts the amount stolen at at least $2 billion.
Binance says it worked with partners to freeze roughly $3 billion in affected assets and will cover all user losses.
The exchange says deposits were unaffected, but withdrawals are suspended and expected to resume in a day or two.
The theft could be the largest crypto hack on record, exceeding the $1.5 billion stolen from Bybit in 2025.
Experts say North Korea uses stolen cryptocurrency to raise money for its economy and nuclear programme.
Blockchain intelligence firms linked the theft of more than $6 billion from Binance to North Korea’s TraderTraitor hacking group.
TRM Labs estimated that about $6.36 billion in digital assets was moved from Binance wallets across 10 blockchain networks.
TRM said most of the funds were moved in about 20 minutes and assessed with high confidence that TraderTraitor was responsible.
Binance said it had frozen roughly $3 billion in affected assets, would cover customer losses and had begun recovering assets for users.
Binance’s investigation was still underway, and the exchange said withdrawals were suspended and expected to resume in the next day or two.
- Who
- TRM Labs, Chainalysis and other firms linked the attack to North Korea’s TraderTraitor hacking group.
- What
- More than $6 billion in cryptocurrency was stolen from Binance. TRM estimated the amount at about $6.36 billion.
- When
- The attack occurred on Thursday, according to the articles.
- Where
- Binance, the world’s largest cryptocurrency exchange; the stolen assets were moved across 10 blockchain networks.
- Why
- Not stated. TRM said the attackers gained access to systems used to authorize cryptocurrency transfers.
This story does not have two clearly opposing sides.
TRM Labs said the hackers began preparing for the attack.
The attackers moved cryptocurrency from Binance wallets across 10 blockchain networks, with most of it moved in about 20 minutes.
Binance said it was beginning to recover assets for users.
- Estimated theft
- About $6.36 billion, according to TRM Labs
- Networks affected
- 10 blockchain networks
- Funds frozen
- Roughly $3 billion, according to Binance and NPR
- Group identified by firms
- TraderTraitor, also known as Lazarus Group in Meduza
- Previous record
- About $1.5 billion stolen from Bybit in February 2025
4 sources
N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm
North Korean hackers linked to Russia suspected in Binance crypto exchange hack
Blockchain intelligence firms link North Korea to $6.3B hack on Binance
What makes North Korea’s state-linked hacker network so powerful?
What people are saying
We make this judgment with high confidence
An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes
working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.
This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet