North Korean hackers blamed for record $6.3B Binance heist
North Korean hackers blamed for a record cryptocurrency theft after researchers tied a Binance breach to Pyongyang-linked operators. Attackers allegedly compromised a company engineer’s laptop, then stole at least $6.3 billion in crypto. About half of the funds have been frozen as the stolen assets moved across blockchains, according to security firms and Binance.
Key Takeaways
- Security firms say North Korean operators stole at least $6.3 billion from Binance, the largest known crypto heist on record.
- Binance says a compromised engineer’s laptop let attackers reach a service container and submit unauthorized withdrawals.
- About $3 billion has been frozen by industry partners, and deposits and withdrawals remain suspended during the probe.
- TRM Labs and Elliptic attribute the breach to North Korea’s TraderTraitor crypto-theft network.
How did the Binance breach happen?
According to TechCrunch, Binance’s initial investigation found that hackers broke into the exchange’s network after targeting a compromised engineer’s laptop. That access allegedly allowed an attacker to reach a service container and submit unauthorized withdrawal transactions.
Binance said it has seen no evidence that its private keys leaked, which would have given attackers broader control over crypto stores. The company has suspended all deposits and withdrawals while the investigation continues. It said user funds are safe, but did not immediately provide proof of that claim, adding it will publish an updated proof of reserves once remediation is complete.
How the laptop was compromised remains unclear. Security researchers note that incidents often start with compromised software, open-source supply-chain tampering, or malware that steals credentials and session tokens from employee devices.
Who says North Korean hackers are responsible?
Blockchain intelligence firm TRM Labs attributed the breach to North Korean hackers and called it the largest hack in history. Researchers describe the cell known as TraderTraitor as focused almost exclusively on stealing crypto from large companies and exchanges.
That same network was previously blamed for a $1.4 billion theft from Bybit in 2025, now the second-largest heist on record. TRM said the Binance theft took about 20 minutes. Elliptic also attributed the Binance theft to North Korean hackers, saying some stolen funds ended up in a wallet used in an earlier Bitget attack that stole $351 million.
U.S. officials and allies have long warned that North Korea steals crypto to fund weapons programs while cut off from the global financial system. Coverage of similar cyber-finance risks continues in our Future Tech & AI Wonders hub.
What is Binance doing to recover the funds?
Binance spokesperson Andie Cooper told TechCrunch that some $3 billion has been frozen by industry partners. The exchange said it has begun recovering affected assets for users and is working with law enforcement, issuers, blockchain intelligence firms, and industry partners to trace, freeze, and recover more funds.
The incident has not been confirmed as fully resolved, and the amount stolen may still change. Binance, the world’s largest crypto exchange, will face questions about why a single employee device could reach systems that control billions in funds. Company spokespeople did not answer TechCrunch questions about prior security audits.