A US-based blockchain intelligence firm said a North Korean cyber unit was likely behind an attack that stole $6.3 billion from Binance, the world’s largest cryptocurrency exchange. Binance said on Friday that deposits were not affected, while withdrawals were suspended and are expected to resume in the next two days. The company, which worked with blockchain partners to freeze approximately $3 billion in affected assets, also said it will cover all customer losses. In a social media post, Binance said an initial investigation suggested the incident may have involved a compromised laptop, while a subsequent investigation uncovered additional “breach points.” Cryptocurrency industry analysts say the attack on Binance is the largest cyber heist ever. What is TraderTraitor? In a post on its website Thursday, technology security firm TRM Labs attributed the attack to TraderTraitor, which it described as North Korea’s elite hacking unit. “We make this judgment with great confidence,” TRM said. “An attacker removed approximately $6.36 billion from Binance wallets across ten blockchains, most of it in about 20 minutes,” the company said. That would make the hack the largest cryptocurrency theft ever recorded, he said. In 2025, TraderTraitor also targeted another cryptocurrency exchange, Bybit, in an attack that resulted in a $1.5 billion loss, according to the FBI. “Several features of this attack are consistent with previous heists linked to North Korea, including the Bybit hack,” TRM said. Jonathan Levin, co-founder and CEO of blockchain research firm Chainalysis, also said on social media that the Binance hack was “likely carried out” by TraderTraitor. United States Department of the Treasury. The Justice Department alleged in 2018 that Lazarus Group was responsible for an attack on Sony Pictures Entertainment four years earlier that leaked a large amount of the company’s confidential data online. Working “round the clock,” Binance said on social media that its “teams are working around the clock to securely and thoroughly resolve this issue. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.” Experts say North Korea has turned to cryptocurrency hacking and other illicit cyber activities as a source of much-needed foreign currency to support its troubled economy and finance its nuclear program in the wake of tough U.N. sanctions and other difficulties. In December 2022, South Korea’s spy agency said North Korean hackers had stolen approximately 1.5 trillion won ($1.1 billion) in cryptocurrency and other virtual assets over the past five years, more than half of it in 2022 alone. It said North Korea’s ability to steal digital assets was considered one of the best in the world. Changpeng Zhao, also known as CZ, founded Binance in 2017. In 2023, he pleaded guilty to a felony related to failing to prevent money laundering on the platform and resigned as CEO of the company. President Trump pardoned Zhao in 2025. Zhao posted on social media Thursday that “User funds are safe!” but added that the theft “looks like a Binance hack.” He added that while he no longer manages Binance, “as a shareholder, I hope that all user funds are fully covered.” Meanwhile, the event also raises questions about why stricter approval controls were not implemented, said Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab. “This looks like a signature that gave the attacker a never-expiring full access token to a Binance hot wallet,” he said, referring to cryptocurrency wallets that hold users’ “private keys,” or unique authorizations, digitally and that are connected to the internet. Binance said on social media that it had “found no evidence of any wallet private key leak” and that the company would publish more technical details when it completes its investigation. Go deeper with The Free Press
