North Korea's 'Elite' Hackers Blamed for Record $6.3bn Binance Theft

The world’s biggest cryptocurrency exchange, Binance, is recovering from a suspected $6.3 billion theft that blockchain intelligence firms attribute to North Korea’s elite hacking unit, according to The Independent ^[2]. The US-based firm TRM stated with high confidence that the group TraderTraitor was behind the attack, which saw approximately $6.36 billion moved out of Binance wallets across ten blockchains in roughly 20 minutes.

If confirmed, the incident would stand as the largest cryptocurrency theft on record, the BBC reported via The Guardian ^[1]. Binance founder Changpeng Zhao, also known as CZ, posted on social media that "User funds are safe!" while acknowledging the event "does look like a hack." Zhao, who pleaded guilty to money laundering charges in 2023 and was pardoned by US President Donald Trump in 2025, added that he expects all user losses to be fully covered as a shareholder.

The exchange has temporarily suspended withdrawals while security checks continue, though deposits remain unaffected. According to CBS News ^[3], Binance collaborated with blockchain partners to secure approximately $3 billion in the stolen assets. The company stated it is working closely with law enforcement to confirm the identity of the criminals and bring them to justice.

TRM noted that several features of this attack match earlier North Korea-linked heists, including the $1.5 billion Bybit hack in February last year, which the FBI attributed to TraderTraitor. Chainalysis co-founder Jonathan Levin also indicated the Binance breach was likely done by the DPRK group. Experts suggest North Korea has turned to crypto hacking to fund its nuclear program and support its troubled economy amidst tough UN sanctions.

Cybersecurity analyst Kok Tin Gan of NyxLab raised questions about why stronger approval controls were not in place, suggesting the attacker may have obtained a "never-expiring, full-access token" to a Binance hot wallet. Binance said it found no evidence of any wallet private key leak and will release more technical details upon completing its probe. The incident highlights the ongoing vulnerability of digital asset platforms to state-sponsored cyber threats.