$6.36 Billion Stolen From Binance in Largest Crypto Heist on Record

An attacker moved $6.36 billion out of Binance wallets on ten different blockchains. Most of that money moved in about 20 minutes. This event marks the largest cryptocurrency theft on record.

Blockchain intelligence firm TRM attributed the attack to a North Korean unit called TraderTraitor. The firm stated it made this judgment with high confidence. TRM noted that several features of the attack match earlier North Korea-linked heists. This includes the Bybit hack from February of last year, which cost that exchange $1.5 billion. The FBI previously said TraderTraitor was responsible for the Bybit breach.

Binance worked with blockchain partners to freeze roughly $3 billion in affected assets. The company announced on Friday that it is beginning to recover assets for users. Binance stated that deposits were unaffected by the breach. Withdrawals were suspended but are expected to resume in the next day or two. The company said it will cover all losses incurred by users.

TRM said the attacker moved the funds out of Binance wallets on ten blockchains. The firm described TraderTraitor as North Korea's elite hacking unit. Chainalysis, another blockchain analysis company, reached a similar conclusion. Co-founder and CEO Jonathan Levin wrote on X that the hack was likely done by the DPRK group TraderTraitor. DPRK is the official name for North Korea. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals.

In an initial investigation, Binance suggested the incident may have involved a compromised laptop. A subsequent investigation uncovered additional points of breach. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the event raises questions about approval controls. Gan noted that the attack looks like a single signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets are connected to the internet and hold users' private keys. Binance said it found no evidence of any wallet private key leak and will release more technical details when its probe is complete.

North Korea has turned to crypto hacking as a source of foreign currency. Experts say the country needs this money to support its troubled economy and fund its nuclear program. This need is heightened by tough U.N. sanctions and other difficulties. In December 2022, South Korea's spy agency reported that North Korean hackers had stolen an estimated 1.5 trillion won, or $1.1 billion, in cryptocurrency in the past five years. More than half of that total was stolen in 2022 alone. The agency considered North Korea's capacity to steal digital assets to be among the best in the world.

Changpeng Zhao, also known as CZ, founded Binance in 2017. In 2023, Zhao pleaded guilty to a felony linked to failing to prevent money laundering on the platform. He stepped down as CEO that same year. U.S. President Donald Trump pardoned Zhao in 2025. Zhao posted on X on Thursday that user funds are safe. He added that the theft looks like a hack on Binance. While Zhao no longer manages the company, he said that as a shareholder, he expects all user funds will be fully covered.

Binance is the world's biggest cryptocurrency exchange. The company said it would cover all losses from the breach. Withdrawals are expected to resume in the next day or two. The firm will release more technical details when its investigation is complete.