North Korean hackers blamed for record breach of at least $6.3B from Binance

Hackers linked to North Korea have been blamed for what researchers are calling the largest cryptocurrency theft on record: at least $6.3 billion drained from the wallets of Binance, the world’s largest crypto exchange. Roughly half of that sum has since been frozen as the funds moved across multiple blockchains, according to security researchers, though the breach is not yet confirmed resolved and the final stolen amount could still change.

Binance said in a post on X that its initial investigation traced the breach to a “compromised” engineer’s laptop, which “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” The company said it has found no evidence its private keys were leaked — which would have given the hacker near-unfettered control of its crypto reserves — and has suspended all deposits and withdrawals while the investigation continues. TechCrunch reported Thursday that withdrawals had already been paused across some of Binance’s blockchains.

Binance said user funds are safe, though it has not yet provided proof of that claim and will publish an updated proof of reserves once remediation is complete. Spokesperson Andie Cooper told TechCrunch Friday that roughly $3 billion of the stolen funds have already been frozen by industry partners, and that the company is now returning assets to affected users while coordinating with law enforcement, token issuers, and blockchain-forensics firms to trace, freeze, and recover whatever remains missing. It remains unclear exactly how the breach occurred or how the engineer’s laptop was compromised in the first place, and Binance has not said whether it had commissioned a third-party security audit of its systems before the attack; the company did not respond to questions about the incident.

Blockchain-intelligence firm TRM Labs attributed the breach to North Korean hackers, calling it the largest hack on record. Researchers describe the group behind it, known as TraderTraitor, as a North Korean cell that focuses almost exclusively on stealing crypto from large exchanges; the same group has been blamed for the previous record, a $1.4 billion theft from Bybit in 2025. TRM estimated the Binance theft itself took about 20 minutes. Blockchain-security firm Elliptic separately linked the breach to North Korea as well, saying some of the stolen funds landed in the same wallet used in an earlier attack on exchange Bitget that took $351 million. Researchers say North Korea, cut off from the U.S. and the global financial system over its nuclear weapons program, steals crypto specifically to help fund that program.

Why it matters

The breach dwarfs the previous record and underscores how a single compromised employee device can still expose billions in centralized crypto holdings, even at the exchange with the deepest security resources in the industry. It also adds to a growing tally of crypto thefts researchers link to North Korea’s weapons-proliferation financing, a pattern that keeps recurring despite years of warnings from the U.S. and its allies.