Binance reports $6.3 billion hack likely linked to North Korean group

Binance said a "complex attack" resulted in the movement of roughly $6.36 billion US out of its wallets across ten blockchains, most of it within about 20 minutes. The exchange reported that deposits remain functional, but withdrawals have been paused and are expected to resume within a day or two. Binance also announced it has frozen approximately $3 billion in affected assets and will reimburse all user losses.

Blockchain intelligence firm TRM attributed the breach to TraderTraitor, described as North Korea's elite hacking unit, stating it makes the judgment with high confidence. The firm noted that several aspects of the attack resemble earlier North Korea-linked incidents, such as the $1.5 billion Bybit hack in February 2023.

Chainalysis co-founder and CEO Jonathan Levin echoed the assessment, indicating the likely involvement of the DPRK group TraderTraitor. A Binance spokesperson said the company is working closely with law-enforcement partners to identify the perpetrators.

Experts highlighted North Korea's reliance on cryptocurrency theft to generate foreign currency amid sanctions. South Korea's intelligence agency previously reported that North Korean hackers stole an estimated $1.1 billion in digital assets over five years, with more than half taken in 2022.

Binance founder Changpeng Zhao, who stepped down as CEO after a 2023 guilty plea and was pardoned by President Donald Trump in 2025, posted on X that user funds are safe and, as a shareholder, he expects full coverage of the losses. Cybersecurity firm NyxLab co-founder Kok Tin Gan suggested the attack may have exploited a never-expiring token granting full access to a Binance hot wallet. Binance said it found no evidence of a private-key leak and will release further technical details after its investigation concludes.