North Korean hacking unit blamed for record $6.36bn Binance crypto theft, as exchange vows full user reimbursement

About US$6.36 billion left Binance wallets across ten blockchains, and most of it went in roughly 20 minutes. That is the account given by TRM, a US-based blockchain intelligence firm, in a post on its website on Thursday. If its figure holds, it would make this the largest cryptocurrency theft on record.

TRM attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit, and said it made that judgment with high confidence. The firm pointed to several features that match earlier North Korea-linked heists, including the hack of the exchange Bybit in February last year, when US$1.5 billion was taken. The FBI said North Korea and TraderTraitor were responsible for that one. Chainalysis, another blockchain analysis company, reached a similar view: its co-founder and CEO, Jonathan Levin, wrote on X that the Binance hack was likely done by the DPRK group TraderTraitor.

Binance itself has not confirmed that attribution. Asked about the potential North Korean ties, a spokesperson said only that the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

On the practical side, Binance said it worked with blockchain partners to freeze roughly US$3 billion in affected assets, and on Friday it said it had begun recovering assets for users. Deposits were unaffected, the exchange said. Withdrawals have been suspended but are expected to resume within a day or two. Binance said it will cover all losses.

How the attackers got in is still being worked out. Binance said on X that its initial investigation suggested the incident may have involved a compromised laptop, but that a later investigation found additional points of breach. It also said it had found no evidence of any wallet private key leak, and that it would publish more technical details once its probe is finished.

Outside experts are already asking about controls. Kok Tin Gan, cofounder and CEO of the cybersecurity firm NyxLab, said the episode raises the question of why stronger approval controls were not in place. In his reading, one signature appears to have handed the attacker a never-expiring, full-access token to a Binance hot wallet, meaning a wallet connected to the internet that holds the private keys, the unique authorisations, digitally. That is his interpretation of the evidence, not a finding Binance has made.

Changpeng Zhao, known as CZ, founded Binance in 2017. In 2023 he pleaded guilty to a felony linked to failing to prevent money laundering on the platform and stepped down as CEO; President Donald Trump pardoned him in 2025. Zhao posted on X on Thursday that user funds are safe and that the theft does look like a hack on Binance. He no longer manages the company, he wrote, but as a shareholder he expects all user funds to be fully covered.

The suspected North Korean role fits a pattern experts describe. They say Pyongyang has turned to crypto hacking and other illicit cyber activity as a source of badly needed foreign currency to support its troubled economy and fund its nuclear program, after tough UN sanctions and other difficulties. In December 2022, South Korea's spy agency estimated North Korean hackers had stolen 1.5 trillion won in cryptocurrency and other virtual assets over the previous five years, more than half of it in 2022 alone, and called the country's capacity to steal digital assets among the best in the world.

What to watch next: whether Binance's promised technical report confirms how the attackers got in, and whether withdrawals do resume within the expected day or two.