North Korean hackers have been identified as the perpetrators behind a massive cyberattack on Binance that resulted in the theft of at least $6.3 billion in cryptocurrency. The incident marks the largest known theft of digital assets in history, according to security researchers who tracked the movement of funds across various blockchains.
Binance, the world’s largest cryptocurrency exchange, confirmed the breach on Friday. The company stated that its initial investigation revealed the attackers gained entry by targeting a compromised laptop belonging to a Binance engineer. This access allowed the intruders to reach a service container and submit unauthorized withdrawal transactions.
North Korean hackers linked to TraderTraitor group
Security firms TRM Labs and Elliptic attributed the attack to a North Korean hacking cell known as TraderTraitor. This group has previously been linked to the $1.4 billion theft from Bybit in 2025. Researchers noted that the Binance breach took approximately 20 minutes to execute.
Elliptic also found connections between the stolen funds and a previous attack on Bitget earlier this year, where $351 million was stolen. The U.S. government and its allies have long warned that North Korea uses cyber theft to fund its nuclear weapons program, as the country remains isolated from the global financial system.
Binance suspends withdrawals and freezes assets
Following the discovery of the breach, Binance suspended all deposits and withdrawals. The company emphasized that there is no evidence of a leak of its private keys, which would have given the hackers unrestricted control over the platform’s reserves. Binance spokesperson Andie Cooper stated that industry partners have already frozen approximately $3 billion of the stolen assets.
“Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds,” Cooper said in a statement.
The exchange assured users that their funds remain safe, though it did not immediately provide proof of this claim. Binance promised to publish an updated proof of reserves once the remediation process is complete. The company has not yet confirmed if the incident is fully resolved, and the final amount of stolen crypto may change as the investigation continues.
Questions remain regarding how a single employee’s device was able to access systems capable of moving billions of dollars. Security incidents often stem from compromised software on employee devices, including malware bundled with legitimate applications. It is unclear if Binance had undergone a recent third-party security audit prior to the hack.
Source: TechCrunch
