North Korean Unit Linked to $6 Billion Binance Hack

A blockchain intelligence firm based in the U.S. identified a North Korean unit as the likely perpetrator of a hack that affected over $6 billion on Binance. Binance, the world’s largest cryptocurrency exchange, collaborated with blockchain partners to freeze approximately $3 billion in compromised assets. The exchange announced on Friday that it has begun the process of recovering assets for affected users.

According to the company, deposits remained secure, although withdrawals have been paused. These are expected to resume within a day or two. Binance pledged to cover all losses resulting from the hack. The company also noted on platform X that an ongoing investigation initially suggested the incident might have involved a compromised laptop. Further inquiries revealed additional “points of breach.”

TRM, in a post on its website, attributed the attack to TraderTraitor, a sophisticated hacking unit from North Korea. “We make this judgment with high confidence,” the firm stated. TRM reported that an attacker transferred about $6.36 billion out of Binance wallets across ten blockchains, predominantly within a span of 20 minutes. This incident marks the largest cryptocurrency theft recorded.

In February of the previous year, another exchange, Bybit, experienced a $1.5 billion breach. The FBI identified North Korea and TraderTraitor as responsible for that incident. “Several features of this attack match earlier North Korea-linked heists, including the Bybit hack,” TRM remarked. Blockchain analysis firm Chainalysis supported this assessment, with its co-founder and CEO Jonathan Levin expressing on X that the Binance hack was “likely done by DPRK group TraderTraitor.” DPRK is an acronym for the Democratic People’s Republic of Korea.

When questioned about potential North Korean connections, a Binance spokesperson confirmed that the company is “working closely with law enforcement partners to identify the criminals and hold them accountable.” North Korea has reportedly turned to crypto hacking as a source of foreign currency, which aids its struggling economy and funds its nuclear program amid strict U.N. sanctions and other challenges.

South Korea’s spy agency reported in December 2022 that North Korean hackers stole an estimated 1.5 trillion won, equivalent to $1.1 billion, in cryptocurrency and other virtual assets over five years. More than half of these steals occurred in 2022 alone. North Korea’s digital theft capabilities are ranked among the top globally.

Binance was founded in 2017 by Changpeng Zhao, known as CZ. In 2023, he pleaded guilty to a felony related to not preventing money laundering on the platform and consequently resigned as CEO. Former U.S. President Donald Trump pardoned Zhao in 2025. On Thursday, Zhao reassured on X that “User funds are safe!” Yet, he acknowledged the situation “does look like a hack on Binance.” Though he no longer manages Binance, Zhao stated as a shareholder his expectation that user funds would be fully covered.

Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, pointed out the lack of stronger approval controls. “This appears as a single signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,” he explained. Hot wallets store users’ “private keys” digitally and are connected to the internet.

Binance asserted on X that they found “no evidence of any wallet private key leak” and committed to releasing more technical details once their investigation concludes.