Binance hack drains $6.3 billion in 20 minutes

Blockchain intelligence firm TRM stated with high confidence that North Korea's elite hacking unit TraderTraitor stole approximately $6.36 billion from Binance. The attacker moved the funds across ten blockchains in roughly twenty minutes. This amount exceeds the $1.5 billion taken from exchange Bybit in February 2025. TRM called this incident the largest cryptocurrency theft in history.

Binance confirmed it is beginning to recover assets for users after freezing about $3 billion in affected holdings. The company said deposits were not impacted during the breach. Withdrawals remain suspended but are expected to resume within one to two days. Binance pledged to cover all user losses from the incident.

The exchange reported that an initial investigation pointed to a compromised laptop. Later probes identified additional points of breach. Binance said it found no evidence of a wallet private key leak. The company will release further technical details once its internal probe concludes.

Chainalysis co-founder and CEO Jonathan Levin also attributed the hack to the North Korean group. He wrote on X that the attack was likely executed by TraderTraitor. A Binance spokesperson noted the company is working with law enforcement to identify the criminals. They aim to bring the attackers to justice.

Experts cite North Korea's reliance on crypto theft to fund its economy and nuclear program amid United Nations sanctions. In December 2022, South Korea's spy agency estimated that North Korean hackers stole $1.1 billion in digital assets over five years. More than half of that total occurred in 2022 alone. The agency rated the country's digital theft capacity as among the best in the world.

Binance founder Changpeng Zhao, who stepped down in 2023 and received a presidential pardon in 2025, commented on the event. He stated on X that user funds are safe. He acknowledged the incident looks like a hack on the platform. As a shareholder, he expects all user funds to be fully covered.

Cybersecurity firm NyxLab cofounder Kok Tin Gan questioned the lack of stronger approval controls. He described the breach as a single signature that granted the attacker a never-expiring full-access token. This token allowed access to a Binance hot wallet. Hot wallets hold private keys and are connected to the internet.