A blockchain intelligence company based in the U.S. has indicated that a North Korean group likely executed the cyberattack that resulted in over $6 billion US being affected on Binance, the largest cryptocurrency exchange globally.
In an announcement made on Friday morning, Binance referred to the incident as a “complex attack” and confirmed that it collaborated with blockchain partners to freeze approximately $3 billion US of the compromised assets. By Friday afternoon, the company revised this amount to $5 billion US.
“Binance has initiated the process of recovering the impacted assets for users and continues to coordinate with law enforcement, asset issuers, blockchain intelligence firms, and industry collaborators to trace, freeze, and recover further funds,” the company shared in a statement to CBC News.
According to the exchange, deposits remained unaffected, though withdrawals have been halted and are anticipated to resume within a day or two. The company assured that it would compensate for all losses incurred.
On Friday, Binance disclosed on X that initial investigations pointed to a compromised laptop as a potential factor, yet further inquiries revealed additional “breach points.”
The blockchain analysis firm TRM noted in a Thursday post that it attributed the attack to TraderTraitor, which it characterized as North Korea’s elite hacking unit. “We express this conclusion with high confidence,” the firm stated.
“An attacker transferred around $6.36 billion US from Binance wallets across 10 blockchains, with most of the movement occurring in approximately 20 minutes,” TRM reported.
This incident would mark the largest recorded theft in the cryptocurrency space, as per their analysis.
In February of the previous year, another crypto exchange, Bybit, faced a loss of $1.5 billion due to a hacking incident. The FBI attributed that breach to North Korea and TraderTraitor.
“Several characteristics of this attack correspond with previous heists linked to North Korea, including the Bybit breach,” TRM noted.
North Korea’s Hacking History
Chainalysis, a blockchain analysis firm, also suggested that the Binance breach was “likely conducted by the DPRK group TraderTraitor,” according to a statement from its co-founder and CEO Jonathan Levin on X. DPRK refers to the Democratic People’s Republic of Korea, North Korea’s official designation.
When questioned about potential connections to North Korea, a spokesperson for Binance stated only that the company is “collaborating closely with our law enforcement partners to ascertain the identities of the criminals and to ensure they face justice.”
Experts indicate that North Korea has increasingly engaged in crypto-hacking and other illegal online activities as a means to acquire much-needed foreign currency to support its struggling economy and fund its nuclear initiatives, particularly in light of stringent UN sanctions and other challenges.
A U.S.-based blockchain intelligence firm says North Korean hackers were likely behind the theft of $6.3 billion US — nearly $9 billion Cdn — on Binance, the world’s largest cryptocurrency exchange. The cryptocurrency exchange said that deposits were unaffected following the ‘complex attack,’ while withdrawals have been suspended and are expected to resume in the next day or two. It said it will cover all losses.
According to South Korea’s intelligence agency, in December 2022, North Korean hackers were reported to have stolen around 1.5 trillion won ($1.1 billion US) in cryptocurrency and other virtual assets over the preceding five years, with a significant portion of that amount taken in 2022. The agency noted that North Korea’s ability to steal digital assets ranks among the best globally.
Changpeng Zhao, a Canadian entrepreneur known as CZ, launched Binance in 2017. In 2023, he admitted guilt to a felony related to the failure to combat money laundering on the platform and subsequently resigned as CEO. U.S. President Donald Trump granted Zhao a pardon in 2025.
-
Trump pardons Canadian Binance CEO who failed to stop illegal activity on crypto platform
-
What we know about ongoing Coldcard hack that’s stolen over $100M worth of bitcoin
Zhao mentioned on Thursday via X that “User funds are safe!” but acknowledged that the theft “does appear to be a hack on Binance.” He also stated that even though he no longer manages Binance, “as a shareholder, I anticipate that all user funds will be fully covered.”
Additionally, this incident raises concerns regarding the lack of stronger approval controls, as pointed out by Kok Tin Gan, co-founder and CEO of the cybersecurity firm NyxLab.
“It seems like a single signature granted the attacker unlimited, perpetual access to a Binance hot wallet,” he noted, referring to cryptocurrency wallets that securely store users’ “private keys,” or unique authorizations, digitally and are connected online.
Binance stated on X that it had “not found any evidence of a leak of any wallet private key” and that the company plans to share more technical information once its investigation is concluded.