North Korea-linked group steals $6.3B from Binance in largest-ever cryptocurrency hack - Cybersecurity Dive
Hackers linked to North Korea stole approximately $6.3 billion in cryptocurrency from Binance in the largest such theft in history, the exchange disclosed on Thursday.
The attackers compromised several systems, including a Binance engineer's laptop, before accessing a privileged system that allowed them to make massive withdrawals, according to the company's social media posts. Binance has suspended withdrawals and deposits while it investigates the theft and is working with law enforcement on the investigation.
Frozen Assets
Blockchain analysis firms have worked with Binance to freeze roughly half of the stolen money. "We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far," Binance stated, adding that it would cover all of the losses.
North Korean Connection
The elite North Korean hacking team TraderTraitor was responsible for the Binance intrusion, according to cryptocurrency analysis firms TRM Labs and Chainalysis. "Several features of this attack match earlier North Korea-linked heists," TRM Labs researchers wrote in a blog post.
including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst.
Attack Details
The hackers began laying the groundwork at least 36 hours before the thefts began, with several test runs involving moving money between hacker-controlled wallets. It took roughly 20 minutes for the attackers to steal most of the money, according to TRM Labs.
Industry Response
A coalition of blockchain analysis companies and cryptocurrency firms worked together to trace and freeze roughly half of the stolen money. This shows an industry increasingly able to act quickly, both independently and together, Chainalysis researchers wrote.
Related
