By Sohaib Shams
U.S.-based blockchain intelligence firm TRM Labs said a North Korean hacking unit known as TraderTraitor was likely behind the theft of more than $6 billion from Binance, the world's largest cryptocurrency exchange. Binance confirmed late Thursday that approximately $6.3 billion was impacted in what its founder described as "like a hack."
Attribution to North Korean Hacking Unit
TRM Labs, in a post on its website Thursday, attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit. "We make this judgment with high confidence," the firm said. An attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, most of it within about 20 minutes, making it the largest cryptocurrency theft on record, according to TRM.
Binance Confirms Impact and Freezes Assets
Binance said it worked with blockchain partners to freeze affected assets, and roughly $3 billion had been frozen. The exchange temporarily suspended deposits and withdrawals while security checks are completed. A Binance spokesperson said the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."
Chainalysis Supports Attribution
Blockchain analysis company Chainalysis also believed the Binance hack was "likely done by DPRK group TraderTraitor," its co-founder and CEO Jonathan Levin wrote on X. DPRK stands for the Democratic People's Republic of Korea, North Korea's official name. Several features of the attack match earlier North Korea-linked heists, including the $1.5 billion hack of cryptocurrency exchange Bybit in February 2025, which the FBI also attributed to North Korea and TraderTraitor.
North Korea's History of Crypto Theft
Experts say North Korea has turned to crypto hacking and other illicit cyber activities as a source of badly needed foreign currency to support its economy and fund its nuclear program amid tough U.N. sanctions. In December 2022, South Korea's spy agency said North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in cryptocurrency and other virtual assets over the previous five years, more than half of it in 2022 alone.
Binance Founder and Security Concerns
Changpeng Zhao, known as CZ, founded Binance in 2017. He pleaded guilty in 2023 to a felony linked to failing to prevent money laundering on the platform and stepped down as CEO. U.S. President Donald Trump pardoned Zhao in 2025. Zhao posted on X that "User funds are safe!" but added the theft "does look like a hack on Binance." Binance said it would cover the losses from the apparent hack. Meanwhile, Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the event raises questions about why stronger approval controls were not in place, suggesting a single signature may have given the attacker a never-expiring, full-access token to a Binance hot wallet. Binance said it found no evidence of any wallet private key leak and would release more technical details when its probe is complete.
