North Korea-linked hackers suspected in $6.3 billion Binance heist
- Binance lost $6.36 billion in a complex attack across ten blockchains.
- Blockchain firms TRM Labs and Chainalysis link the hack to North Korea's TraderTraitor unit.
- Binance has reserved $6.34 billion to cover the incident and is working on asset recovery.
- The theft is four times larger than the $1.5 billion Bybit hack from February 2025.
- Bitcoin and Ethereum prices fell significantly following reports of the record-breaking heist.
Binance experienced a theft of $6.36 billion from its wallets across ten different blockchains. The attacker moved most of these funds within a 20-minute window, making this the largest cryptocurrency theft on record.
Binance described the incident as a "complex attack" on $6.34 billion of its funds. The exchange is currently working with blockchain partners to freeze about $3 billion in affected assets.
TraderTraitor and North Korea linked to the attack
Blockchain investigation firms have attributed the attack on Binance to an elite hacking unit known as TraderTraitor. This group is believed to be a part of the Lazarus Group, which is linked to North Korea.
TRM Labs stated with high confidence that TraderTraitor carried out the theft based on on- and off-chain intelligence. Chainalysis also identified the group as the likely perpetrator.
Chainalysis co-founder Jonathan Levin wrote on X that the Democratic People’s Republic of Korea (DPRK), the official name of North Korea, likely conducted the $6.4 billion hack through this unit. TraderTraitor has been accused of previous attacks on cryptocurrency exchanges.
Binance reserves funds and initiates recovery efforts
Binance has set aside more than $6.34 billion in corporate capital to address the incident. Within this total, $5 billion is maintained in the identical token assets that were affected.
The exchange has started recovering affected assets for users.
Market reacts as major cryptocurrencies drop
Bitcoin fell 4% to USD 77,465 following reports of the hack. Major cryptocurrencies saw immediate declines as Bitcoin and Ethereum plunged 5% and 6% respectively.
BNB, the native coin of Binance, dropped 1% in the wake of the hack.
Attack patterns mirror previous Bybit and Sony hacks
TRM, a blockchain intelligence firm, observed that various characteristics of the Binance attack align with previous North Korea-linked heists. These include the February 2025 hack of the Bybit crypto exchange, which resulted in a USD 1.5 billion loss.
The FBI held the group TradeTraitor responsible for the Bybit theft in February 2025. The current Binance theft is about four times the size of that Bybit hack.
The group faced accusations of hacking Sony Pictures in 2014. This was in retaliation for the film The Interview, which mocked the leader of North Korea.
Historical context of North Korea’s statehood
North Korea is a one-party state governed by the Kim family. On 2 September 1945, the Korean Peninsula was split into occupation zones, followed by the creation of two sovereign nations in 1948.
The Korean War occurred from 1950 to 1953, ending in an armistice agreement without a formal peace treaty. Both North and South Korea joined the United Nations in 1991.
Frequently Asked Questions
Add NewsPulse Time as a preferred source on Google