A recent investigation by US-based blockchain intelligence firms has linked North Korea's elite hacking unit, TraderTraitor, to a massive $6.3 billion hack on Binance, the world's largest cryptocurrency exchange. According to TRM, a blockchain analysis firm, the attack was carried out with high confidence by TraderTraitor, which is known for its sophisticated cyber attacks. The hack, which occurred recently, involved the theft of assets from Binance wallets on multiple blockchains.
Binance has reported that it worked closely with blockchain partners to freeze approximately $3 billion in affected assets and has begun recovering assets for its users. The exchange assured that user deposits were unaffected, while withdrawals were temporarily suspended and are expected to resume shortly. Binance has also pledged to cover all losses incurred during the hack. An initial investigation suggested that the incident may have involved a compromised laptop, but further investigation revealed additional breach points.
The $6.3 billion hack on Binance is believed to be one of the largest cryptocurrency thefts on record. TRM reported that an attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, with most of the assets being transferred within a 20-minute window. This significant theft has raised concerns about the security of cryptocurrency exchanges and the tactics employed by North Korean hackers to obtain foreign currency.
The FBI previously linked North Korea and TraderTraitor to a $1.5 billion hack on Bybit, another cryptocurrency exchange, in February last year. TRM noted that several features of the Binance hack match earlier North Korea-linked heists, including the Bybit hack. Chainalysis, another blockchain analysis company, also believes that the Binance hack was likely carried out by TraderTraitor, according to its co-founder and CEO Jonathan Levin.
North Korea has increasingly turned to cryptocurrency hacking and other illicit cyber activities to support its troubled economy and fund its nuclear program. The country has faced tough UN sanctions and other difficulties, leading it to seek alternative sources of foreign currency. In December 2022, South Korea's spy agency reported that North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in cryptocurrency and other virtual assets over the past five years.
Binance founder Changpeng Zhao, also known as CZ, pleaded guilty to a felony related to money laundering on the platform in 2023 and stepped down as CEO. He was pardoned by US President Donald Trump in 2025. Zhao has since assured that user funds are safe, while acknowledging that the theft does appear to be a hack on Binance. As a shareholder, he expects all user funds to be fully covered.
The incident has raised questions about the security measures in place at Binance and the need for stronger approval controls. Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, noted that the hack appears to have been facilitated by a single signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Binance has stated that it found no evidence of any wallet private key leak and will release more technical details once its investigation is complete.
Key points
- North Korea's TraderTraitor unit was likely behind the $6.3 billion hack on Binance.
- The hack is one of the largest cryptocurrency thefts on record.
- North Korea has increasingly turned to cryptocurrency hacking to support its economy and nuclear program.
