North Korean Hackers Linked to Record $6.3 Billion Binance Crypto Heist in Largest Theft in History

Hackers operating on behalf of the North Korean regime have been blamed for a staggering and unprecedented cryptocurrency heist following a massive cyberattack on Binance, the world’s leading digital asset exchange. According to prominent blockchain security researchers and forensic firms, the attackers managed to siphon at least $6.3 billion in cryptocurrency directly from the company’s wallets in a lightning-fast operation that took roughly 20 minutes to execute.

The security breach stands by far as the largest known theft of cryptocurrency in history, completely eclipsing previous major heists that have rattled the digital finance sector over the years. However, the rapidly unfolding incident has not yet been fully resolved, and industry observers caution that the final tally of stolen funds remains fluid as recovery efforts and tracking operations continue across multiple blockchain networks. Security analysts and blockchain intelligence providers have noted that swift defensive actions by industry partners successfully froze approximately half of the stolen assets while the illicit funds were actively being moved and splintered across various blockchains.

In an official statement published on the social media platform X, Binance revealed the initial findings of its ongoing internal investigation. The exchange stated that the cyberattack began when the hackers successfully infiltrated the company’s corporate network by targeting a compromised laptop belonging to a Binance engineer. According to the company, this initial vector allowed an unauthorized attacker to gain entry into a designated service container, which subsequently enabled them to submit unauthorized withdrawal transactions that bypassed traditional oversight mechanisms.

Despite the severe breach and the massive outflow of funds, Binance explicitly maintained that its preliminary investigation has revealed no evidence of a leak or compromise of its master private keys. In the realm of cryptocurrency administration, a private key leak would grant an attacker near-unfettered, supreme control over an exchange’s entire reserves, potentially leading to a catastrophic total loss of all customer funds. By contrast, the vector utilized in this attack appears to have targeted a specific internal workflow rather than the foundational cryptographic architecture of the platform.

In response to the emergency, Binance—which holds the position of the world’s largest cryptocurrency exchange by trading volume—immediately suspended all deposits and withdrawals while its security teams, technical staff, and external experts intensified their remediation and investigation efforts. TechCrunch previously reported on Thursday that the exchange had initially implemented withdrawal pauses across select blockchains before widening the defensive measures.

Binance officials moved quickly to reassure its massive global user base, declaring emphatically that "user funds are safe," though the company did not immediately provide cryptographic proof or detailed financial attestations to substantiate that assertion at the time of the initial announcement. In its subsequent communications, the exchange promised to publish an updated and comprehensive proof of reserves report once the full scope of remediation and asset recovery is officially finalized.

Further details regarding the ongoing asset recovery operations were shared with TechCrunch on Friday by Binance spokesperson Andie Cooper. According to Cooper’s statement, roughly $3 billion of the stolen cryptocurrency has already been successfully frozen through coordinated intervention by industry partners, major stablecoin issuers, and blockchain intelligence firms. The spokesperson emphasized that Binance has proactively begun recovering affected assets for its users while continuing to work in close partnership with international law enforcement agencies, token issuers, and forensic investigators to trace, freeze, and repatriate additional tranches of the stolen funds.

While the broad strokes of the attack vector are beginning to come to light, many critical operational questions remain unanswered. It is still entirely unclear how the hack was executed in precise detail, or under what specific circumstances the employee’s laptop was initially compromised. Nevertheless, cybersecurity experts point out that it is far from uncommon for major enterprise security incidents to originate from the inadvertent use of compromised software, flawed packages, or malicious dependencies on employee hardware.

Modern software development pipelines are typically constructed from a vast array of individual components, including numerous open-source projects and third-party libraries. Over the past several years, malicious actors have increasingly targeted, compromised, and modified these open-source packages in sophisticated supply chain attacks designed to steal sensitive data, credentials, and session tokens from the devices upon which the software is installed. In other recurring scenarios, malware covertly bundled with seemingly innocuous applications, games, or developer utilities can quietly capture usernames, passwords, and authentication tokens from infected computers. This stolen information can then allow remote hackers to masquerade as legitimate enterprise employees, logging into corporate systems with authentic credentials and effectively bypassing perimeter defenses.

The unprecedented nature of the breach means Binance will inevitably face intense scrutiny and difficult questions from regulators, users, and the broader cybersecurity community. Observers are likely to question why the company’s internal access controls and privileged identity management systems allowed a single employee’s laptop to possess administrative pathways capable of authorizing transactions involving billions of dollars in customer and corporate funds.

Representatives for Binance did not respond to subsequent email inquiries regarding the specifics of the breach, the exact nature of the employee compromise, or the architecture of their internal authorization systems. Furthermore, it remains unclear whether Binance commissioned an independent third-party security audit of its network infrastructure and internal systems prior to the incident. Major financial technology companies and cryptocurrency exchanges regularly retain specialized outside firms to conduct rigorous stress-tests, penetration testing, and vulnerability assessments designed to identify hidden weaknesses before malicious actors can exploit them, but the existence or timing of any such review at Binance has not yet been publicly disclosed.

The attribution of the cyberattack has fallen swiftly upon specialized blockchain intelligence and forensic enterprises. Security researchers at TRM Labs formally attributed the multi-billion-dollar breach to North Korean state-sponsored hackers, officially labeling the event as the largest hack in digital asset history.

Researchers describe this specific network of state-backed hackers—widely tracked within the cybersecurity industry under the moniker TraderTraitor—as an elite North Korean cyber cell focused almost exclusively on orchestrating complex, high-value crypto thefts from large corporations, decentralized finance protocols, and centralized exchanges. Notably, this exact same threat group has previously been blamed by international investigators for other historic digital heists, including a massive $1.4 billion theft from cryptocurrency exchange Bybit in 2025, which previously held the record for the second-largest crypto robbery on record. According to forensic reconstruction by TRM Labs, the rapid execution of the Binance theft allowed the perpetrators to drain the billions in cryptocurrency in a remarkably compressed timeframe of approximately 20 minutes.

Independent verification of the threat actor’s identity came swiftly from another prominent blockchain security firm, Elliptic. In its published analytical insights, Elliptic also attributed the Binance theft directly to North Korean state hackers, highlighting concrete on-chain forensic evidence linking the operation to previous cyber campaigns. Specifically, Elliptic noted that a portion of the freshly stolen funds was routed into the exact same crypto wallet addresses that had been utilized in a previous high-profile cyberattack against cryptocurrency exchange Bitget earlier in the year, during which hackers absconded with $351 million in what was previously considered the largest digital theft of the year up to that point.

These findings align with long-standing warnings issued by the United States government and its international allies regarding the persistent and escalating threat posed by North Korea’s cyber warfare units. Chronically isolated from the United States and the broader global financial system due to heavy international sanctions tied to its ongoing development of banned nuclear weapons and ballistic missile programs, the regime in Pyongyang has increasingly turned to state-sponsored cybercrime as a primary mechanism for revenue generation. Cybersecurity researchers and international intelligence agencies have repeatedly emphasized that the sole strategic motivation behind these relentless state-backed heists is to accumulate massive reserves of cryptocurrency and fiat currency to fund the continued development of weapons of mass destruction, entirely bypassing traditional economic sanctions.