Binance Suspends Trading After Suspected Hack Linked to North Korean Hacking Unit

Binance, the world's largest cryptocurrency exchange, stopped deposits and withdrawals on Thursday for what it called security checks, after a suspected hack that blockchain analysts now tie to North Korea. Users could not trade while the investigation went on.

The scale of the theft is what has set the story apart. The US-based blockchain intelligence firm TRM said attackers moved roughly $6.36 billion out of Binance wallets across 10 blockchains, most of it in about 20 minutes. TRM described it as the largest cryptocurrency theft on record. In a report published Thursday, it attributed the attack to TraderTraitor, an elite North Korean hacking unit, and said it made that judgment with high confidence.

TRM pointed to a pattern. Several features of the attack, it said, match earlier North Korea-linked heists, including the hack of the exchange Bybit, which lost $1.5 billion in February 2025. The FBI attributed that attack to North Korea and TraderTraitor. Jonathan Levin, co-founder and CEO of the blockchain analysis company Chainalysis, also said the Binance attack was likely the work of TraderTraitor. Experts say North Korea uses cryptocurrency theft and other illicit cyber activity to obtain foreign currency and help fund its nuclear program despite international sanctions.

Binance has not confirmed the attribution. It said it was working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice. The company said it had located and frozen about $3 billion so far, and it gave no information about the remaining $3.3 billion.

On how the breach happened, Binance offered an early account. Its initial investigation suggested an attacker had compromised the laptop of a software infrastructure engineer, which gave access to an internal service and allowed unauthorized withdrawals to be submitted. The company said it had found no evidence that wallet private keys were leaked.

Other firms helped with the freezing. Tether froze around $1.6 billion in its USDT currency, according to CEO Paolo Ardoino, and Circle froze some $800 million worth of USDC, according to its boss, Jeremy Allaire.

Binance co-founder Yi He said the company will cover all hacking losses, though she gave no further detail about the incident. A company spokesperson said users could rest assured their funds were completely safe. Changpeng Zhao, who founded Binance in 2017, said that as a shareholder he expects all user funds to be fully covered.

Zhao's name carries its own history. He stepped down as CEO after pleading guilty in 2023 to failing to prevent money laundering on the platform, and US President Donald Trump pardoned him in 2025. Zhao and Binance have been key supporters of cryptocurrency ventures run by Trump and his family.

The market reacted quickly. Bitcoin fell 3.2% on Thursday evening, dropping below $79,000. What to watch now is whether Binance confirms the North Korea attribution, how the unaccounted-for $3.3 billion is dealt with, and whether Bitcoin's decline lasts.