Blockchain intelligence firms link North Korea to $6.3B hack on Binance - NPR

The cryptocurrency exchange confirmed it worked with blockchain partners to freeze approximately $3 billion in affected assets and has begun recovering funds for users. While deposits remained unaffected, withdrawals were suspended and are expected to resume within the next day or two. Binance has pledged to cover all losses resulting from the breach.

The company initially suggested the incident might involve a compromised laptop, but subsequent investigations revealed additional "points of breach." The scale of the hack, with approximately $6.36 billion moved out of Binance wallets across ten blockchains in about 20 minutes, would make it the largest cryptocurrency theft on record if confirmed.

North Korean Connection

TRM, a blockchain intelligence firm, attributed the attack to TraderTraitor, describing it as North Korea's elite hacking unit with "high confidence." The firm noted that several features of this attack matched earlier North Korea-linked heists, including the $1.5 billion Bybit hack in 2025, which the FBI also linked to North Korea and TraderTraitor.

Chainalysis co-founder and CEO Jonathan Levin also believed the Binance hack was "likely done by DPRK group TraderTraitor." DPRK stands for the Democratic People's Republic of Korea, North Korea's official name. When asked about potential ties to North Korea, a Binance spokesperson only confirmed the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."

North Korean Cyber Operations

Experts believe North Korea has increasingly turned to crypto hacking and other illicit cyber activities to generate foreign currency for its troubled economy and nuclear program, particularly amid tough U.N. sanctions. In December 2022, South Korea's spy agency estimated that North Korean hackers had stolen 1.5 trillion won ($1.1 billion) in cryptocurrency and other virtual assets over five years, with more than half occurring in 2022 alone.

Changpeng Zhao, who founded Binance in 2017 and stepped down as CEO in 2023 after pleading guilty to a felony related to money laundering, posted on X that "User funds are safe!" while acknowledging the theft "does look like a hack on Binance." He added that as a shareholder, he expects "all user funds will be fully covered."

Security Concerns

The breach has raised questions about Binance's security measures. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, suggested the attack may have involved "a never-expiring, full-access token to a Binance hot wallet." Binance countered that it had "found no evidence of any wallet private key leak" and promised to release more technical details once its investigation is complete.