Hackers working for the North Korean regime have been blamed for a record cryptocurrency theft following a cyberattack on crypto exchange Binance. Hackers stole at least $6.3 billion in crypto from the company’s wallets, although about half of that amount was frozen as the stolen crypto traveled across various blockchains, according to security researchers.
The breach is by far the largest known crypto theft in history, although the incident has not yet been confirmed and resolved, and the amount of crypto stolen may change.
In a post on
Binance said it has seen no evidence of a leak of its private keys, which would give the hacker near unlimited control over the company’s crypto stores.
The crypto exchange – the world’s largest – said it has now suspended all deposits and withdrawals while its investigation into the breach continues. TechCrunch reported on Thursday that the exchange had suspended withdrawals on some of its blockchains.
Binance stated that “user funds are safe” but did not immediately provide proof of this claim. The company said it would “publish an updated proof of reserves once remedial actions have been completed.”
Spokesperson Andie Cooper said in a statement shared with TechCrunch on Friday that some $3 billion had been frozen by industry partners. The spokesperson said Binance has “begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.”
It’s not clear how the hack occurred or under what circumstances the employee’s laptop was compromised, but it is not uncommon for security incidents to stem from the use of compromised software on employee devices.
Software is typically built from numerous components, including open source projects, which hackers regularly target, compromise and modify in order to steal data from devices on which the affected software is installed. Other times, malware associated with regular-looking apps and games can allow hackers to steal usernames, passwords, and session tokens from infected computers, allowing them to log in as if they were legitimate employees.
Binance will face questions about why company security allowed a single employee’s laptop to access systems capable of controlling billions of dollars in funds.
Binance spokespersons did not respond to an email with questions about the breach. TechCrunch also asked the company who, if anyone, conducted a security audit of Binance’s network and systems before the hack. Companies regularly ask third-party companies to test their security to identify weaknesses that could be exploited by attackers, but it is unclear whether Binance has requested such a review.
Security researchers at TRM Labs, a blockchain intelligence and forensics company, attributed the breach to North Korean hackers and called it “the largest hack in history.”
Researchers describe the hacker network, known in the cybersecurity industry as TraderTraitor, as a North Korean cell focused almost exclusively on stealing cryptocurrencies from large companies and exchanges. This group was also accused of the second largest heist on record, a $1.4 billion theft from crypto exchange Bybit in 2025.
According to TRM, the theft of billions of cryptocurrencies from Binance took around 20 minutes.
Blockchain security company Elliptic also attributed the Binance theft to North Korean hackers. Elliptic said some of the stolen funds ended up in the same wallet used in a previous cyberattack on crypto exchange Bitget earlier this year, in which hackers stole $351 million.
The U.S. government and its allies have long warned of the threat from North Korea, which remains cut off from the United States and the global financial system for the continued development of its nuclear weapons program. Researchers say the separatist country’s only motivations are to steal as many cryptocurrencies as possible in order to continue developing its authorized weapons of mass destruction.
Updated with Binance’s statement.
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.
Gn bussni
