Analysts Link Binance’s $6.3 Billion Heist to North Korea

About $6.36 billion moved out of Binance wallets across 10 blockchains, much of it in just 20 minutes. Blockchain analysis firms TRM Labs and Chainalysis now say North Korea’s TraderTraitor hacking group likely carried out the theft, the biggest crypto theft on record. Binance has not confirmed who was behind it, so this remains the analysts’ assessment, not the exchange’s finding. ^7,9

TraderTraitor is the name TRM Labs gives to a North Korean hacking unit it links to earlier crypto thefts. The firm says the Binance attack resembles past operations, including the 2025 Bybit hack, which the FBI blamed on the same group. Binance’s early investigation pointed to a DevOps engineer’s compromised laptop as a possible way in, but later found other points where attackers may have gained access. The company says it found no evidence that wallet private keys were leaked. Its partners have frozen about $3 billion in assets. ^5,7,9

Those $3 billion in frozen assets are only part of the picture: Binance says it has not recovered all the stolen funds. The exchange has set aside more than $6.34 billion in company funds to cover losses, with $5 billion already held in the affected tokens. It says it has begun recovering assets for users. The breach still shook markets. Bitcoin and other major cryptocurrencies fell, while crypto-linked stocks also dropped. Binance says customer funds are safe, but withdrawals were paused while it checked its systems. ^1,2,9

Binance said withdrawals are expected to resume within 48 hours as its investigation continues with law enforcement partners. Customers should check their accounts and use Binance’s official channels, not messages offering urgent help or compensation. The company’s next task is to finish security checks, restore withdrawals and account for the assets still missing. ^9,14,15