North Korea is being identified by multiple blockchain intelligence firms as the likely perpetrator of a $6.3 billion cryptocurrency theft from Binance, the world's largest cryptocurrency exchange, in what has become the largest crypto heist on record.
CNN reported that the attack occurred on Thursday after hackers gained unauthorised access to digital wallets held by Binance. The incident affected cryptocurrency across multiple blockchains, with most of the funds moved within roughly 20 minutes.
US blockchain intelligence firm TRM Labs has attributed the attack with high confidence to TraderTraitor, a North Korean hacking unit. Chainalysis has independently said it has high confidence that North Korea was behind the attack, while Singapore-based Pangolin Intelligence reached a similar conclusion.
TRM Labs later estimated the value of the cryptocurrency moved from Binance-controlled wallets at approximately $6.36 billion, making it about four times larger than the $1.5 billion Bybit theft in 2025, which US authorities attributed to North Korea.
How the Binance Hack Happened
Binance's preliminary investigation initially indicated that the attackers may have gained access through a compromised laptop belonging to a DevOps engineer.
According to Binance, the compromised device allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
The exchange later said its investigation had identified additional breach points and was continuing. Binance also said it had found no evidence that wallet private keys had been leaked.
TRM Labs' analysis provided a more detailed picture of the attack.
The company said approximately $6.36 billion was moved from Binance-attributed wallets across 10 blockchains, with most of the transfers taking place within about 20 minutes.
On Ethereum, TRM said the attackers used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper controlled by the attacker, while other affected chains saw ordinary signed transfers.
The scale and speed of the transactions immediately raised questions about how the attackers obtained sufficient access to Binance's wallet-signing infrastructure.
About $3 Billion Has Been Frozen
The hackers have not been able to move all of the stolen assets freely.
Binance said it worked with blockchain companies and other industry partners to freeze approximately $3 billion of the affected cryptocurrency.
Stablecoin issuers Tether and Circle, along with Ripple and World Liberty Financial, were among the companies that froze assets linked to the attack. TRM Labs said roughly $2.67 billion in stablecoins had been frozen, while additional assets were frozen on the Arbitrum network.
That response highlights one of the unusual characteristics of cryptocurrency theft.
Although blockchain transactions can be pseudonymous, transfers are publicly recorded. Once investigators identify wallets associated with a theft, they can monitor the movement of funds and alert cryptocurrency exchanges, stablecoin issuers and other companies.
Stablecoin issuers can also freeze tokens in wallets identified as being connected to criminal activity.
However, the attackers have continued moving some of the cryptocurrency through decentralised exchanges and lending protocols.
TRM said the attacker still controlled more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion based on its analysis.
North Korea Attribution
The North Korean attribution is currently based on intelligence and blockchain analysis rather than a court finding.
TRM Labs said it reached its conclusion using both on-chain and off-chain intelligence and described its confidence as high.
The company linked the attack to TraderTraitor, which it describes as an elite North Korean hacking unit. The group has also been linked to previous major cryptocurrency thefts.
Chainalysis separately told CNN that it had high confidence North Korea was responsible. Pangolin Intelligence also identified a North Korean hacking unit based on similarities between the Binance attack and previous incidents involving North Korean cyber actors.
Blockchain investigator ZachXBT separately pointed toward the Lazarus Group, the North Korean state-linked hacking organisation frequently associated with major cryptocurrency thefts.
North Korea has previously denied allegations that it is responsible for cryptocurrency hacking operations.
CNN said it contacted North Korea's mission to the United Nations for comment. There was no immediate response reported.
The Largest Crypto Theft Ever Recorded
If the current estimate is confirmed, the Binance incident is the largest cryptocurrency theft ever recorded.
TRM Labs put the amount at approximately $6.36 billion, while other blockchain investigators have produced somewhat different estimates. Chainalysis initially estimated the amount at about $5.9 billion, illustrating why the final figure could change as investigators reconstruct every transaction.
The previous record was the February 2025 attack on Bybit, when approximately $1.5 billion in cryptocurrency was stolen.
The FBI attributed that attack to North Korea.
The Binance theft would therefore represent a dramatic escalation in the scale of cryptocurrency theft attributed to North Korean cyber actors.
Binance Says Customers Will Be Protected
Despite the enormous amount involved, Binance has said customers will not be responsible for the losses.
The exchange said it would cover the losses using company funds and its emergency asset-protection arrangements.
Binance also said user funds were safe and temporarily suspended deposits and withdrawals while security checks were conducted. The company expected withdrawals to resume within roughly one to two days.
The company has also been working with law-enforcement agencies and blockchain intelligence firms to identify the attackers and recover as much of the cryptocurrency as possible.
The incident nevertheless represents a major security challenge for Binance because of the amount of cryptocurrency that was accessible through the compromised infrastructure.
North Korea's Long Record of Crypto Theft Allegations
The Binance attack fits into a broader pattern of cryptocurrency thefts that international authorities and private cybersecurity companies have linked to North Korea.
North Korean hacking groups have been accused of targeting cryptocurrency exchanges, decentralised finance projects and other digital-asset businesses to generate funds for the isolated country's economy.
The United States and South Korea have repeatedly accused North Korean cyber actors of stealing cryptocurrency.
Private blockchain firms have also documented extensive cryptocurrency theft attributed to North Korean groups.
The attacks have become particularly significant because cryptocurrency can potentially provide revenue that is harder for international sanctions to block than traditional banking transactions.
The United Nations and private researchers have previously reported on North Korea's alleged use of cyber operations to generate funds.
Crypto Markets React
News of the Binance attack also sent shockwaves through cryptocurrency markets.
Bitcoin fell sharply, reaching a six-week low, while Ether dropped to a two-month low. Binance-linked BNB and other major digital assets also came under pressure.
The market reaction reflected concerns that the attack could undermine confidence in centralised cryptocurrency exchanges.
Centralised exchanges hold large quantities of digital assets on behalf of customers, making them particularly attractive targets for sophisticated attackers.
The Binance incident has therefore raised questions about whether exchanges need stronger controls around wallet access, employee devices and transaction approvals.
A Major Test for Crypto Security
The attack is likely to become a major case study for cryptocurrency security teams.
The apparent compromise of an employee's computer demonstrates that attackers do not necessarily need to break directly into a blockchain network.
Instead, compromising an individual, gaining access to internal infrastructure and obtaining the ability to authorise transactions can potentially provide a pathway to enormous amounts of cryptocurrency.
The speed of the Binance attack also highlights the difficulty of responding once a breach begins.
TRM said most of the $6.36 billion was moved within approximately 20 minutes. By the time investigators and exchanges began freezing assets, billions of dollars had already been transferred across different blockchain networks.
The ability of Tether, Circle, Ripple and other companies to freeze significant amounts of the stolen assets has prevented the attackers from freely controlling the entire haul.
But billions of dollars remain in circulation and investigators are still tracking them.
Investigation Remains Ongoing
The North Korean attribution is now supported by multiple independent blockchain intelligence firms, but the investigation has not reached a judicial conclusion.
Binance has not publicly declared North Korea responsible, and authorities have not announced criminal charges against identified individuals in connection with the attack.
For now, the strongest available evidence comes from blockchain analysis and comparisons with previous North Korean-linked operations.
What is established is that cryptocurrency worth approximately $6.3 billion was moved from Binance-controlled wallets, making the incident the largest crypto theft recorded so far.
What remains to be determined is exactly how the attackers obtained the necessary access, how much cryptocurrency they will ultimately be able to retain, and whether investigators can recover the remaining funds.
The incident also places renewed attention on North Korea's alleged cyber-financing operations and the security of the cryptocurrency industry's largest exchanges.
As investigators continue tracking the money, the Binance breach has become more than a record-breaking crypto theft. It is now a major test of whether the global digital-asset industry can identify, freeze and recover billions of dollars after a sophisticated cyberattack.
