North Korean hackers linked to $6.3 billion Binance crypto theft
Security researchers say a North Korean hacking group accessed a Binance employee’s laptop, enabling the theft of at least $6.3 billion in cryptocurrency, half of which has been frozen.
Security researchers have attributed a massive cryptocurrency theft at Binance to a North Korean hacking group. The breach, described as the largest known crypto heist, involved the compromise of a Binance engineer’s laptop, which gave attackers access to a service container and allowed unauthorized withdrawal transactions.
Binance said its initial investigation found no evidence that private keys were leaked, and it has suspended all deposits and withdrawals while the investigation continues. The exchange asserted that user funds are safe and promised to publish updated proof of reserves after remediation.
Spokesperson Andie Cooper told TechCrunch that about $3 billion of the stolen assets have been frozen by industry partners and that Binance is working with law-enforcement agencies, blockchain intelligence firms and other partners to trace, freeze and recover additional funds.
TRM Labs, a blockchain forensic firm, identified the hacker network known as “TraderTraitor” as a North Korean cell focused on stealing crypto from large exchanges. Elliptic also linked the theft to North Korean actors, noting that some of the stolen funds were moved to a wallet previously used in a cyberattack on Bitget.
The incident follows a $1.4 billion theft from Bybit in 2025, also blamed on the same group. Researchers said the Binance theft was executed in roughly 20 minutes. Binance has not responded to requests for comment on its security practices or any prior security audits.