North Korean Hackers Implicated in Binance Cryptocurrency Theft
A blockchain intelligence firm in the U.S. has indicated that a North Korean group is likely responsible for a hack affecting over $6 billion at Binance, the largest cryptocurrency exchange globally. In response, Binance collaborated with blockchain partners to freeze approximately $3 billion of the impacted assets. The company announced on Friday that it is in the process of recovering assets for users. Deposits remain secure, while withdrawals are temporarily suspended but expected to restart within a couple of days. Binance has committed to covering all user losses.
Binance’s post on X highlighted that an initial investigation pointed to a potentially compromised laptop being involved in the breach. However, further investigation unveiled more security vulnerabilities. An intelligence post from TRM on Thursday attributed the attack to TraderTraitor, characterized as a highly skilled North Korean hacking unit. TRM expressed high confidence in their assessment, reporting that approximately $6.36 billion was illicitly moved from Binance wallets spread across ten blockchains, with most transactions occurring within a span of 20 minutes. This hack represents the largest cryptocurrency theft on record, according to TRM.
Previously, in February last year, Bybit, another cryptocurrency exchange, suffered a $1.5 billion hack. The FBI linked this previous attack to North Korea and TraderTraitor. TRM noted several similarities between the Binance breach and earlier North Korean-linked thefts, such as the Bybit incident. Chainalysis, another blockchain analysis company, also concluded that the breach was “likely done by DPRK group TraderTraitor,” as stated by co-founder and CEO Jonathan Levin on X.
A Binance spokesperson acknowledged the ongoing investigation. They confirmed the company is collaborating closely with law enforcement to identify and apprehend those responsible. Experts assert that North Korea has increasingly relied on cryptocurrency hacking and other such activities to generate vital foreign currency. This supports its struggling economy and funds its nuclear program amid strict U.N. sanctions.
Reports from South Korea’s spy agency in December 2022 revealed that North Korean hackers stole approximately $1.1 billion in cryptocurrency and other digital assets over the past five years. North Korea’s ability to steal digital assets ranks among the highest globally.
Binance was founded in 2017 by Changpeng Zhao, commonly known as CZ. In 2023, Zhao conceded to a felony charge related to inadequate anti-money laundering measures and resigned as CEO, later receiving a pardon from U.S. President Donald Trump in 2025. Zhao reassured via X that “User funds are safe!” Yet, he acknowledged the theft “does look like a hack on Binance.” Although no longer overseeing Binance, Zhao, as a shareholder, expects all user funds to be restored.
This incident raises concerns about the adequacy of Binance’s security protocols. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, questioned why stronger access controls were not implemented. Gan suggested that an inadequate security signature might have provided attackers with an indefinite full-access token to Binance’s hot wallet, which stores sensitive user data digitally and remains internet-connected. Binance stated on X that no evidence suggests any wallet private key was leaked, promising to divulge more technical details once their investigation concludes.