Hackers stole approximately $6.36 billion in cryptocurrency from wallets held at Binance, the world’s largest cryptocurrency exchange, in what investigators have described as the biggest crypto heist on record. Blockchain analysis firms have attributed the attack to North Korea’s elite hacking unit, while Binance has said it will cover all losses and that user funds are safe.The attack involved the movement of funds across 10 blockchains, with most of the cryptocurrency transferred in about 20 minutes, according to US blockchain analysis firm TRM Labs. As cryptocurrency firms raced to trace and recover the stolen assets, about $3 billion had been frozen by Thursday night in the US, CNN reported.Binance CEO Richard Teng has since said the attack was more complex than initially described, adding that the exchange has found no evidence of a wallet private key leak.
What happened in the Binance hack ?
TRM Labs said an attacker moved approximately $6.36 billion out of Binance wallets across 10 blockchains.“An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes,” the firm said in a blog post.Binance’s initial investigation indicated that the breach involved an engineer’s laptop, which allegedly allowed an attacker to access a service container and submit unauthorised withdrawal transactions.However, Teng subsequently said the attack was not a simple case of an attacker exploiting one employee’s access. “The attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” Teng said, according to Reuters, adding that it was a more “complicated attack process”.Teng also said the investigation had not attributed responsibility to any individual. The exchange has found no evidence so far that a wallet private key was leaked.The exchange also said it had “temporarily suspended deposits and withdrawals while security checks are completed; revoked the affected address authorization; [and] engaged law enforcement and blockchain intelligence partners to trace and recover funds”.Binance said it was working closely with law enforcement to ensure the matter was handled appropriately. Changpeng Zhao, Binance’s co-founder and former CEO, also said he expected user funds to be fully covered by the exchange. Zhao, who stepped down as CEO in 2023 but remains its largest shareholder, said on X that the incident appeared to be a hack.
Hackers from North Korea?
TRM Labs attributed the theft to TraderTraitor, an elite North Korean hacking unit, saying its assessment was based on intelligence gathered both on and off the blockchain.“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence,” the firm said, as quoted by Reuters.Other blockchain intelligence firms have also pointed to North Korea. Singapore-based Pangolin Intelligence said its assessment followed an analysis of transactions associated with the hack and comparisons with previous incidents involving the North Korean cyber unit.“Analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents [involving the North Korean cyber unit]” led to the attribution, an analyst with Pangolin Intelligence told CNN.Chainalysis, another cryptocurrency-tracing firm, said it was monitoring the stolen funds as they moved across multiple blockchains, including Bitcoin and Ethereum. A Chainalysis spokesperson told CNN the firm had “high confidence” North Korea was behind the attack.However, the attribution remains an assessment by private intelligence firms and has not been independently established as a confirmed finding by law enforcement.North Korean hacking groups have repeatedly been accused of stealing cryptocurrency and targeting financial institutions. Current and former US and South Korean officials have described cybercrime as a key source of revenue for the sanctions-hit country.In February 2025, North Korean hackers were blamed for an alleged $1.5 billion theft from Bybit, another major cryptocurrency exchange. That incident had set the previous record for the largest crypto heist.North Korean hackers have stolen billions of dollars from banks and cryptocurrency firms over several years, according to reports from the United Nations and private companies.A 2023 CNN investigation also highlighted efforts by South Korean intelligence officials and private cryptocurrency-tracking experts to seize about $1 million in cryptocurrency stolen by North Koreans from a victim.
Why are cryptocurrency exchanges vulnerable?
Unlike platforms for trading stocks, cryptocurrency exchanges often hold digital assets on behalf of their users. This can make them attractive targets for hackers seeking to steal large amounts of cryptocurrency, particularly in an industry where regulatory oversight varies.Binance was co-founded in 2017 by Canadian national Changpeng Zhao and became the world’s largest cryptocurrency trading platform within a year of its launch.Zhao stepped down as CEO in 2023 after pleading guilty to violating anti-money laundering laws in the US. He was sentenced to four months in federal prison and was pardoned by President Donald Trump in October 2025.
What happens next?
Binance has pledged to cover all losses resulting from the incident using its Secure Asset Fund for Users (SAFU) and company funds.“Binance will cover all losses from the SAFU fund and company funds,” the exchange said, according to Reuters. Teng reiterated the commitment, saying the company was “covering every loss”.In its earlier statement also, Binance said it would “cover all losses” from company funds and its emergency assets fund, adding that “user funds are safe”.Meanwhile, Cryptocurrency firms are continuing to trace the stolen funds and attempt to prevent the attackers from converting or moving the assets beyond recovery.A Pangolin Intelligence analyst told CNN that the effort to track the stolen cryptocurrency was still in its early stages. “I think the cat and mouse game has barely begun yet,” the analyst said, adding that North Korea was likely poised to tap a network of money-laundering organisations to cash out the stolen funds.The recovery effort will depend on how much of the cryptocurrency can be traced and frozen before it is moved through other wallets or converted into assets that are harder to recover.Bitcoin and Ether, the two most widely traded cryptocurrencies, fell following news of the Binance breach but recovered some losses. They were trading about 2 per cent to 3 per cent lower by midday Friday in Hong Kong.
