North Korean Unit Linked to $6.36 Billion Binance Hack
TRM Labs attributes the massive theft to the elite hacking group TraderTraitor, marking the largest cryptocurrency robbery in history.
By Rebecca Foster ·
A North Korean hacking unit likely stole 6.36 billion US dollars from Binance, according to a new assessment by the blockchain intelligence firm TRM Labs. The firm identified the perpetrator as TraderTraitor, described as an elite group of hackers. TRM stated it made this determination with a high degree of confidence. If verified, this incident becomes the largest cryptocurrency heist on record.
Binance, the world’s largest cryptocurrency exchange, announced on Friday that withdrawals have been suspended. The company expects to resume those operations within one to two days. Binance stated that user deposits remained unaffected during the breach. The firm also declared that it will cover all losses associated with the attack.
TRM detailed that an attacker moved the funds across ten different blockchains. The majority of the transfer occurred within a 20-minute window. The firm noted that several characteristics of this attack match previous thefts linked to North Korea. This includes the 1.5 billion dollar hack of the exchange Bybit in February 2025, which the FBI attributed to the same North Korean group.
Chainalysis, a blockchain analysis company, reached a similar conclusion. Jonathan Levin, the firm’s co-founder and chief executive, wrote on X that the hack was probably carried out by the DPRK group TraderTraitor. A Binance spokesperson said the company is working closely with security partners to confirm the criminals' identities and bring them to justice.
Binance revealed that an initial investigation suggested a compromised personal computer played a role in the incident. Subsequent probes uncovered additional vulnerability points. The company stated it did not find evidence of private wallet key leaks. More technical details will be released when the investigation concludes.
Kok Tin Gan, co-founder of cybersecurity firm NyxLab, questioned the strength of access controls. He suggested a single signature may have granted an attacker full and unlimited access to a hot wallet. These wallets store digital keys and are connected to the internet. Gan’s analysis highlights the specific technical failure that allowed the rapid transfer of assets.
Changpeng Zhao, who founded Binance in 2017, commented on the event on X. Zhao, who pleaded guilty to a felony in 2023 and was pardoned by President Donald Trump in 2025, said user funds are safe. He added that the incident appears to be a hack of Binance and expressed hope that all user funds would be fully covered as a shareholder.
