Binance's $6.3 Billion Hack Likely Carried Out by North Korea's TraderTraitor, Experts and FBI Say

Binance, the largest cryptocurrency exchange in the world, told customers on Friday that deposits were unaffected but withdrawals were suspended, with a restart expected within a day or two. The pause followed a theft that analysts describe as the biggest cyber heist ever recorded.

The company worked with blockchain partners to freeze roughly $3 billion in affected assets, and said it will cover all customer losses. In a social media post, Binance said an initial investigation pointed to a possibly compromised laptop, but that a later probe turned up additional "points of breach." It also said it had found no evidence that any wallet private key leaked, and that it will publish more technical details once the investigation is finished.

On Thursday, the U.S.-based blockchain intelligence firm TRM Labs posted its assessment: the attack was the work of TraderTraitor, which it described as North Korea's elite hacking unit. "We make this judgment with high confidence," the firm said. By its count, the attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it in roughly 20 minutes. TRM said several features of the attack match earlier North Korea-linked heists, including the Bybit hack. Jonathan Levin, co-founder and CEO of the research firm Chainalysis, said on social media that TraderTraitor likely did it.

The FBI went further on Saturday, accusing TraderTraitor directly. In a statement, the bureau said the hackers have been converting the stolen funds into Ethereum and are preparing them for "further laundering stages." The FBI also said TraderTraitor targeted the exchange Bybit in 2025, in an attack that cost $1.5 billion.

Analysts believe TraderTraitor's members belong to a wider North Korean hacking organization known as Lazarus Group, which according to the U.S. Treasury Department targets institutions across government, finance and other fields. The Justice Department alleged in 2018 that North Korea was behind an attack on Sony Pictures Entertainment four years earlier, which leaked a large volume of sensitive company data online.

Experts say Pyongyang has turned to crypto theft and other illicit cyber activity as a source of badly needed foreign currency, to prop up a troubled economy and fund its nuclear program in the face of tough U.N. sanctions. In December 2022, South Korea's spy agency estimated that North Korean hackers had stolen about 1.5 trillion won ($1.1 billion) in crypto and other virtual assets over the previous five years, more than half of it in 2022 alone, and called the country's capacity to steal digital assets among the best in the world.

Changpeng Zhao, known as CZ, founded Binance in 2017. In 2023 he pleaded guilty to a felony tied to failing to prevent money laundering on the platform and stepped down as CEO. On Thursday he posted that "User funds are safe!" while acknowledging the theft "does look like a hack on Binance." He no longer manages the company, he wrote, but as a shareholder he expects all user funds to be fully covered.

The breach has also prompted questions about internal safeguards. Kok Tin Gan, cofounder and CEO of the cybersecurity firm NyxLab, asked why stronger approval controls were not in place. In his reading, one signature appears to have handed the attacker a never-expiring, full-access token to a Binance hot wallet, meaning an internet-connected wallet that holds users' private keys digitally.

Binance says its teams are working around the clock and with law enforcement to identify the culprits. Watch for the company's full technical report, the movement of the stolen funds through Ethereum, and whether the exchange's approval controls come under scrutiny.