By Basant El-Faramawy
Binance, the world's largest cryptocurrency exchange, and its founder Changpeng Zhao have become victims of what appears to be the largest crypto heist in history, with an estimated $6.3 billion in bitcoin stolen from customers on Thursday.
North Korea-linked hacking group blamed
Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, described as North Korea's elite hacking unit. South Korean intelligence considers crypto hackers north of the DMZ among the world's best. Pyongyang has repeatedly turned to cryptocurrency theft to circumvent U.N. sanctions amid its nuclear weapons program.
Exchange begins recovery efforts
Binance said Friday it is working with blockchain partners to freeze roughly $3 billion in affected assets and has begun returning funds to users. Zhao posted on X that "User funds are safe!"
From regulatory target to presidential pardon
Zhao, a former McDonald's worker in Canada who founded Binance in 2017, pleaded guilty in 2024 to violating the U.S. Bank Secrecy Act, becoming the first person sentenced to prison for such charges. He served four months after admitting to allowing transactions with sanctioned entities including Iran, Hamas' Al-Qassam Brigades, and al-Qaida.
In October 2025, President Donald Trump pardoned Zhao, citing unfair treatment by the previous administration. The White House called it a response to the "Biden Administration's war on crypto." Binance and Zhao had supported Trump's 2025 inauguration and the Trump family's crypto venture World Liberty Financial. Both denied any quid pro quo arrangement.
Rapid rise amid global scrutiny
Binance grew from a China-based startup to the dominant global exchange, surpassing rivals like Coinbase and FTX. Forbes estimates Zhao's net worth exceeds $100 billion. The exchange operated without a fixed headquarters, moving between Japan, Malta, and Jersey while facing mounting regulatory pressure worldwide.
