Binance, the world’s largest cryptocurrency exchange, has suffered what could become the biggest cryptocurrency theft in history after hackers stole approximately $6.3 billion in digital assets. Blockchain intelligence firms have attributed the attack to North Korean hackers, raising fresh concerns about the security of major crypto platforms and the growing sophistication of state-linked cybercrime.
According to blockchain analytics firm TRM Labs, the attackers transferred approximately $6.36 billion from Binance wallets across multiple blockchain networks. Most of the stolen assets were moved in roughly 20 minutes, making the incident significantly larger than previous major cryptocurrency thefts.
TRM Labs believes the attack was carried out by TraderTraitor, a North Korean hacking group associated with the country’s broader cyber operations. The firm said its assessment was based on similarities between the Binance incident and previous attacks attributed to the group. Blockchain analytics company Elliptic has also linked the incident to North Korean actors, although the attribution has not been independently confirmed by law enforcement.
The suspected attackers reportedly gained access to Binance’s internal systems by compromising an employee’s laptop. Binance said its initial investigation identified a compromised engineer’s device that allowed an attacker to access a service container and submit unauthorized withdrawal transactions.
Importantly, Binance said it had found no evidence that its private keys had been leaked. Private keys are critical security credentials that authorize cryptocurrency transactions, and their compromise could give attackers extensive control over digital assets.
The exchange temporarily suspended deposits and withdrawals as it investigated the incident. Binance also maintained that customer funds remained protected and promised to cover the losses using its own resources.
The scale of the theft quickly drew comparisons with the February 2025 attack on Bybit, in which hackers stole approximately $1.5 billion in cryptocurrency. That incident was also attributed to North Korean hackers. If the Binance attribution is confirmed, it would represent another major operation by a group believed to use cryptocurrency theft to generate revenue for North Korea.
There has been some progress in recovering the stolen assets. Binance said that approximately $3 billion had been frozen through cooperation with cryptocurrency companies, stablecoin issuers and blockchain infrastructure providers. These efforts involved industry partners capable of freezing certain digital assets when suspicious transactions are identified.
However, freezing cryptocurrency is not always straightforward. Stablecoins such as USDT and USDC can be frozen by their issuers, but decentralized cryptocurrencies such as Bitcoin and Ether do not have a central authority with the same capability. Researchers have warned that attackers may attempt to convert stolen stablecoins into assets that are more difficult to freeze.
Blockchain intelligence firm Elliptic estimated that more than $6.4 billion in assets were initially stolen, while approximately 44% of the funds had been frozen by the time of its latest assessment. The figures may change as investigators continue tracking transactions across different networks.
The FBI has also confirmed that it is aware of the incident and is coordinating with government and private-sector partners to understand its scope and assess potential impacts. However, U.S. authorities have not yet publicly confirmed responsibility for the attack.
North Korea has become one of the most closely monitored actors in cryptocurrency-related cybercrime. Security researchers have repeatedly linked groups associated with the country to attacks targeting exchanges, blockchain platforms and digital asset companies. The stolen funds are widely believed to help finance the regime’s activities, including its weapons and military programs, while circumventing international sanctions.
For Binance, the incident represents a major test of its security infrastructure and its ability to maintain customer confidence. The company has said it is working with law enforcement agencies, blockchain intelligence firms and other industry participants to trace and recover the assets. Co-CEO Richard Teng also stated that Binance had reserved more than $6.34 billion in company funds to cover the affected assets.
The attack raises broader questions about the security architecture of centralized cryptocurrency exchanges. Even when private keys remain protected, compromised employee devices, internal services and transaction authorization systems can create vulnerabilities with enormous financial consequences.
As cryptocurrency platforms handle increasingly large amounts of digital wealth, protecting wallets alone may no longer be sufficient. Internal access controls, employee device security and transaction monitoring are becoming equally critical components of exchange security.
The Binance breach is a stark reminder that the biggest risks in the crypto industry do not always come from weaknesses in blockchain technology itself. Sometimes, the most vulnerable point is the infrastructure connecting people, systems and billions of dollars in digital assets.
Leave a Reply