North Korea’s elite cyber unit was likely behind a massive security breach that drained roughly $6.3 billion from Binance, according to blockchain intelligence firms and U.S. federal investigators, marking what analysts describe as the largest cryptocurrency heist in history.
In a post published Thursday, tech security firm TRM Labs attributed the attack to TraderTraitor, a specialized North Korean hacking collective. TRM Labs stated it made the judgment with high confidence after tracking an attacker who shifted approximately $6.36 billion out of Binance wallets across ten blockchains, executing the bulk of the transfer in about 20 minutes.
The FBI echoed those findings on Saturday, stating that TraderTraitor carried out the breach and is currently converting the stolen funds into Ethereum to prepare them for subsequent laundering stages. The federal agency noted that TraderTraitor was also behind a 2025 attack on the Bybit crypto exchange that resulted in a $1.5 billion loss. Jonathan Levin, co-founder and CEO of blockchain research firm Chainalysis, similarly stated on social media that the Binance breach bore the hallmarks of the North Korean hacking group.
Industry analysts connect TraderTraitor members to the broader Lazarus Group, a state-sponsored hacking apparatus that the U.S. Treasury Department says targets institutions across government, finance, and other sectors. The U.S. Justice Department previously alleged that the Lazarus Group was responsible for the 2014 cyberattack on Sony Pictures Entertainment that exposed a vast quantity of confidential corporate records.
Binance reported that customer deposits remained unaffected by the incident, though withdrawals were temporarily suspended and anticipated to resume within a day or two. The exchange stated it has been working with blockchain partners to freeze approximately $3 billion in affected assets and pledged to cover all customer losses entirely. Initial investigations suggest a compromised laptop may have been involved, followed by a subsequent probe that uncovered additional breach points. In a social media statement, the company noted that its teams are operating around the clock to resolve the situation safely and collaborating closely with law enforcement to identify and prosecute the perpetrators.
Changpeng Zhao, who founded Binance in 2017, posted on social media that user funds are secure and that the incident appears to be an external hack. Although Zhao pleaded guilty in 2023 to a felony charge related to anti-money laundering failures and stepped down as CEO before receiving a presidential pardon in 2025, he noted that he remains a shareholder and expects all customer funds to be fully covered.
Security experts note that North Korea has increasingly relied on illicit cyber operations and cryptocurrency theft to generate foreign currency, supporting its strained economy and nuclear weapons program amidst stringent United Nations sanctions. South Korea’s intelligence agency reported in December 2022 that North Korean hackers had amassed an estimated 1.5 trillion won, equivalent to about $1.1 billion, in virtual assets over the preceding five years.
The breach has also drawn scrutiny regarding the exchange’s internal authorization controls. Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, suggested the attack may have exploited a single signature granting a permanent, full-access token to an internet-connected hot wallet. In response, Binance maintained on social media that its investigation has found no evidence of any wallet private key leak and promised to release further technical details upon completing its review.
