(AP) — A U.S.-based blockchain intelligence firm says a North Korean hacking unit is the most likely culprit behind a theft that moved more than $6 billion from wallets connected to Binance, the world’s largest cryptocurrency exchange, in what would be the biggest crypto heist on record.
Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets and that it had begun recovering funds for users. The company said deposits were not affected but that withdrawals were suspended and were expected to resume within a day or two; Binance added it will cover all losses, according to the company’s public statements on X.
TRM Labs, in a post on its website Thursday, attributed the attack to TraderTraitor, which it described as an elite North Korean hacking unit. “We make this judgment with high confidence.” TRM also said, “An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes.” The firm said several features of the theft match earlier incidents linked to North Korea.
Sen. Rubio says a war with Iran may lack popular support but would be necessary
Cheesecake Factory posts earnings gain tied to site at center of Obama-Trump dispute
Blockchain analysis company Chainalysis’ co-founder and CEO, Jonathan Levin, wrote on X that the Binance hack was also “likely done by DPRK group TraderTraitor.” DPRK is the Democratic People’s Republic of Korea, the formal name for North Korea.
A Binance spokesperson declined to confirm a North Korean link, saying the company was “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.” Binance said an initial probe suggested the incident may have involved a compromised laptop, but that follow-up work uncovered additional “points of breach.”
The attack drew comparisons to a February hack of the Bybit exchange, which suffered an estimated $1.5 billion loss; the FBI attributed that incident to North Korean actors and to TraderTraitor, TRM noted. In its Thursday post, TRM said the scale and signatures of the Binance theft resembled those earlier North Korea-linked heists.
Security experts quoted in the reporting said the intrusion appears to have relied on a compromise that granted long-term or full access to a hot wallet. Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, said, “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet.” Binance responded that it had “found no evidence of any wallet private key leak,” and that it would release more technical details when its investigation is complete.
U.S. and international officials have warned for years that North Korean cyber operations increasingly target virtual assets as a source of foreign currency. South Korea’s intelligence agency said in December 2022 that North Korean hackers stole about 1.5 trillion won (roughly $1.1 billion) in cryptocurrency and other virtual assets over the preceding five years, with more than half taken in 2022, and described North Korea’s capability to steal digital assets as among the world’s most developed.
The Binance hack also reinvigorated attention on the exchange’s past regulatory and compliance troubles. Changpeng Zhao, who founded Binance in 2017, pleaded guilty in 2023 to a felony related to failing to prevent money laundering on the platform and stepped down as CEO; President Donald Trump issued Zhao a pardon in 2025. Zhao posted on X Thursday that “User funds are safe!” and added that while he no longer manages Binance, “as a shareholder, I expect all user funds will be fully covered.”
Investigations are ongoing, and Binance said it will publish more findings as its probe concludes. TRM and Chainalysis’ public assessments were posted by those firms and reported by The Associated Press.
