Suspected North Korean Hackers Drain $6.3 Billion From Binance in Minutes

Within about an hour of the theft, two companies that issue digital dollars had already moved to lock down what they could. Circle froze roughly US$971 million of its stablecoin, and Tether froze about US$825 million of its own. By then, hackers had drained US$6.3 billion from Binance, the world's largest cryptocurrency exchange, and the money had left in a matter of minutes.

The scale is what has stunned people in the industry. Ido Ben-Natan, chief executive of the crypto security company Blockaid, called it not only the biggest hack in crypto but the biggest hack in the world, ever. The previous record, according to the cyber security firm CrowdStrike, was a US$1.5 billion theft from the exchange Bybit in 2025, which was eventually attributed to North Korean attackers. Binance has paused withdrawals while it runs security checks.

Much is still unknown, including how the attackers got inside Binance in the first place. What can be seen is where the money went, because transactions on a blockchain are public. In the hours after the heist, crypto research firms scrambled to trace funds moving from Binance into other wallets, and at least three companies have published reports on their findings.

Those analysts describe a cat-and-mouse game. The hackers split the loot across many wallets, apparently knowing that issuers of centrally controlled coins would try to freeze it. Chainalysis wrote that the volume of transactions suggested automated activity, used to obscure the trail by shuffling money rapidly in and out of wallets. Binance now says about US$3 billion of the stolen funds have been frozen by various partners.

But not every asset can be frozen. Bitcoin and similar currencies live on fully decentralised networks where no one can pull the plug. TRM Labs, a blockchain intelligence company, said it watched the hackers race to convert their haul into those assets by seeking out loan platforms and market-makers willing to make the swap. In all, TRM Labs said, at least US$2.4 billion appears to be beyond any issuer's reach.

Binance has not said who it believes is responsible, but two cyber security firms attribute the attack to TraderTraitor, a North Korean group. Chainalysis said money stolen from Binance had mingled with funds from a US$388 million heist at another exchange last month, also attributed to North Korean attackers. TRM Labs estimates that North Korean hackers have stolen US$12.8 billion in cryptocurrency across more than 100 incidents since 2017; the country's estimated domestic gross product in 2025 was about US$26 billion. TraderTraitor was also identified in the Bybit theft, which likewise took only minutes. TRM investigator Nick Carlsen said a couple of hundred elite hackers are now far exceeding what North Korea once earned from its exports, and called the activity basically the government's primary source of hard currency.

Binance says it will refund customers using its own money plus a US$1 billion bitcoin reserve built for hacks and other emergencies. In a statement on social media on Saturday, it said it has already set aside funds to cover 90% of the losses and is committed to covering the remaining 10%. Binance.US, its American version, said it was not affected. The company says it is coordinating with global law enforcement, and several US agencies say they are aware of the hack or investigating. Secret Service spokesman Thomas Lynch said investigators are working around the clock with private-sector partners, including Circle, to identify, freeze, trace and recover the funds taken on Thursday.

Binance has a difficult legal history. In 2023, its chief executive Changpeng Zhao pleaded guilty to violating criminal anti-money-laundering rules, and the company pleaded guilty to criminal charges after prosecutors accused it of allowing transactions from al-Qaeda, the Islamic State, Hamas and other groups. It was fined US$4.3 billion. Zhao stepped down and was later pardoned by President Donald Trump, whose Administration said he had been unfairly targeted by the Biden Administration.

What to watch now: when Binance lifts its withdrawal pause, whether the TraderTraitor attribution is formally confirmed, and how much of the unfrozen money law enforcement can recover.