Binance freezes $3 billion after record-breaking cyber theft

North Korean hackers have executed the largest cryptocurrency theft on record, siphoning $6.36 billion from Binance, the world's biggest digital asset exchange. Blockchain intelligence firm TRM attributed the attack to TraderTraitor, a unit it described as North Korea's elite hacking group. The firm stated it made this judgment with high confidence after analyzing the movement of funds across ten different blockchains.

The attacker moved the stolen assets in approximately 20 minutes. Binance reported that it worked with partners to freeze roughly $3 billion of the affected assets. The company announced on Friday that it is beginning to recover funds for users. While deposits remained open, withdrawals are suspended and are expected to resume within one to two days. Binance stated it will cover all user losses.

Initial internal investigations suggested the incident began with a compromised laptop. Subsequent reviews uncovered additional points of breach. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, noted that the attack appears to involve a single signature that granted the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold private keys and are connected to the internet. Binance said it found no evidence of a private key leak and plans to release further technical details once its probe is complete.

The incident follows a similar attack in February 2025, when the exchange Bybit lost $1.5 billion. The FBI attributed that heist to North Korea and TraderTraitor. TRM said several features of the current Binance attack match those earlier North Korea-linked incidents. Jonathan Levin, co-founder and CEO of Chainalysis, also wrote on X that the hack was likely done by the TraderTraitor group. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals.

North Korea has increasingly relied on cyber activities to generate foreign currency to support its economy and nuclear program. In December 2022, South Korea's spy agency reported that North Korean hackers stole an estimated $1.1 billion in digital assets over the previous five years. Changpeng Zhao, who founded Binance in 2017, posted on X that user funds are safe. Although he stepped down as CEO in 2023 after pleading guilty to a money laundering felony, Zhao, a shareholder, said he expects all user funds to be fully covered. President Donald Trump pardoned Zhao in 2025.