Binance reports $6.3 billion crypto theft linked to North Korean hackers
The world's largest crypto exchange said about $6.3 billion was moved from its wallets in a rapid attack, attributing the operation to a North Korean hacking unit and pledging to cover user losses.
Binance announced that roughly $6.3 billion was transferred out of its wallets across ten blockchains during a 20-minute breach that began late on Thursday. The exchange halted deposits and withdrawals and said it would use its emergency fund to compensate affected users, assuring that user funds remain safe.
Blockchain analysis firms TRM Labs and Chainalysis identified the attack as being carried out by TraderTraitor, a unit associated with North Korea's Lazarus Group. TRM said it had "high confidence" in this attribution, while Binance’s co-CEO Richard Teng noted that the investigation had not yet assigned responsibility to any individual.
Approximately $3 billion of the stolen assets have been frozen, including more than $2.3 billion by stablecoin issuers Tether and Circle. Binance warned that the total amount could rise as it continues to trace and block further transfers.
The theft follows a previous record loss of $1.5 billion from the exchange Bybit in February 2025. Analysts said the incident underscores the vulnerability of centralized exchanges, which hold large volumes of user assets. "Any assets held at a centralised exchange are only as safe as the exchange itself," said Sean Foley of Macquarie University.
Crypto market prices slipped after the news, with Bitcoin falling to a six-week low of $76,368 and Ether dropping to $2,178. Shares of Coinbase declined 4.8 percent, though the company said it was not directly affected.
Binance said it is cooperating with law-enforcement agencies and expects to resume withdrawals within 45 hours.