Binance Freezes $3B After Hack That Moved $6.36B in 20 Minutes

Two blockchain intelligence firms say a North Korean hacking unit likely drained about $6.36 billion from Binance wallets across ten blockchains, with most of the money moving in roughly 20 minutes. If confirmed, the theft would be the largest cryptocurrency heist on record, exceeding the $1.5 billion taken from Bybit in February 2025. The FBI blamed that earlier attack on North Korea and TraderTraitor.

TRM said Thursday it attributes the attack to TraderTraitor, described as North Korea's elite hacking unit, with high confidence. Chainalysis CEO Jonathan Levin wrote on X that the incident was 'likely done by DPRK group TraderTraitor,' using the official name for North Korea. TRM said several features of the Binance attack match earlier North Korea-linked heists, including Bybit.

Binance said it has frozen roughly $3 billion in affected assets and began returning funds to users Friday. Deposits continued to operate while withdrawals were suspended, with service expected to resume within a day or two. The exchange said it will cover all losses. The company's initial inquiry pointed to a compromised laptop, but a later review identified additional 'points of breach.' Binance said it found no evidence of a wallet private key leak and will share technical details when the probe ends.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the incident raises questions about why stronger approval controls were not in place. 'This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,' he said, referring to internet-connected wallets that store users' private keys. Asked about possible North Korea links, a Binance spokesperson said only that the company is 'working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.'

Changpeng Zhao, known as CZ, founded Binance in 2017 and stepped down as CEO in 2023 after pleading guilty to a felony tied to failures in preventing money laundering; President Donald Trump pardoned him in 2025. Zhao posted on X Thursday that 'User funds are safe!' while acknowledging the theft 'does look like a hack on Binance.' He added that as a shareholder he expects all user funds to be fully covered.

North Korea has drawn on crypto theft and other illicit cyber activity as a source of foreign currency for its economy and nuclear program amid U.N. sanctions. South Korea's spy agency said in December 2022 that North Korean hackers stole an estimated 1.5 trillion won, or $1.1 billion, in cryptocurrency and virtual assets over five years, with more than half of that in 2022.