North Korean hackers blamed for stealing record $6.3B in Binance breach

Hackers working for the North Korean regime have been blamed for a record cryptocurrency heist following a cyberattack at crypto exchange Binance. The hackers stole at least $6.3 billion in crypto from the company’s wallets, though about half of that amount was frozen as the stolen crypto traveled across various blockchains, according to security researchers.

The breach is by far the largest known theft of crypto in history, though the incident has not been confirmed yet to be resolved, and the amount of crypto stolen may change.

In a post on X, Binance said its initial investigation showed that the hackers broke into the company’s network after targeting a “compromised” Binance engineer’s laptop, which “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”

Binance said it has seen no evidence of a leak of its private keys, which would grant the hacker near-unfettered control over the company’s stores of crypto.

The crypto exchange — the world’s largest — said it has now suspended all deposits and withdrawals while its investigation into the breach continues. TechCrunch reported on Thursday that the exchange had paused withdrawals across some of its blockchains.

Binance said “user funds are safe,” but did not immediately provide proof of this claim. The company said it will “publish an updated proof of reserves once the remediation is complete.”

It’s unclear how the hack went down or under what circumstances the employee’s laptop was compromised, but it’s not uncommon for security incidents to stem from the use of compromised software on employee devices.

Software is generally built from many components, including open-source projects, which hackers regularly target, compromise and modify in order to steal data from devices that the affected software is installed on. Other times, malware bundled with regular-looking apps and games can allow hackers to steal usernames, passwords and session tokens from infected computers, which may let them log in as if they were a legitimate employee.

Binance will face questions about why the company’s security allowed a single employee’s laptop to access systems capable of controlling billions of dollars in funds.

Spokespeople for Binance did not respond to a request for comment about the hack. TechCrunch has also asked the company who, if anyone, performed a security audit of Binance’s network and systems prior to the hack. Companies regularly ask third-party companies to stress-test their security to identify weaknesses that could be exploited by attackers, but it’s unclear if Binance sought such a review.

Security researchers at TRM Labs, a blockchain intelligence and forensic company, attributed the breach to North Korean hackers, and called it the “largest hack in history.” 

Researchers describe the network of hackers, known in the cybersecurity industry as TraderTraitor, as a North Korean cell focused almost exclusively on stealing crypto from large companies and exchanges. This group was also blamed for the now-second-largest heist on record, a $1.4 billion theft from crypto exchange Bybit in 2025.

According to TRM, the theft of Binance’s billions in crypto took about 20 minutes.

Blockchain security firm Elliptic also attributed the Binance theft to North Korean hackers. Elliptic said some of the stolen funds ended up in the same wallet that was used in a previous cyberattack on crypto exchange Bitget earlier this year, in which hackers stole $351 million.

The U.S. government and its allies have long warned about the threat from North Korea, which remains cut off from the U.S. and the global financial system for its ongoing development of its nuclear weapons program. Researchers say the breakaway country’s sole motivations are to steal as much crypto as possible in order to continue developing its sanctioned weapons of mass destruction.

Topics

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.