Blockchain analysts linked the hackers to a North Korean hacker group that stole an estimated $6.3bn in crypto from Binance.
The hackers took much of the money in about 20 minutes late Thursday, according to TRM Labs and Chainalysis, two US blockchain intelligence firms. TRM Labs put the losses at around $6.36bn. The attackers siphoned funds from Binance wallets across approximately 10 blockchains, it said.
Both firms state that TraderTraitor, a North Korean-linked hacker group, carried out the attack. FBI previously identified it in connection with the $1.5bn heist from Bybit in February 2025.
Chainalysis also pointed to evidence that some of the stolen Binance funds had been mixed with the proceeds of a recent attack on Bitget, which was also attributed to North Korean hackers.
Binance moved very quickly to reassure customers that their funds would be protected. On Friday, the company announced they had set aside over $6.34bn of their own money to cover the losses, including $5bn already held in the relevant cryptocurrencies.
The company suspended withdrawals as it addressed the breach. It assures customers their assets were safe. Binance also reported that its partners had frozen approximately $3bn of the stolen crypto.
The initial investigation pointed to a potential compromise of an engineer’s laptop, which could have given attackers access to the systems used to process withdrawals. Binance later said the incident was more complicated and involved multiple points of access. They also said there was no evidence that private keys had been leaked.
“We are committed to covering all hacked losses through our company funds. Your assets are safe,” Binance co-CEO Richard Teng wrote on X.
Blockchain analysts have called it the largest crypto theft on record. British blockchain analytics firm Elliptic went further, describing it as “almost certainly the single largest known theft of any kind”.
North Korea has on numerous occasions been accused by U.S. and South Korean authorities of using state-sponsored hacking groups to steal money, including crypto, as a source of revenue for the regime.
Chainalysis has reported that North Korea-linked hackers have stolen at least $6.75bn in crypto as of the end of 2025.
Crypto prices dropped a bit after the news of the Binance breach, then settled again. Binance said it expected to restore withdrawals within about 48 hours.
About The Author
