North Korean hackers blamed for Binance theft
Researchers say at least $6.3 billion was stolen from Binance wallets, with about half later frozen as the funds moved across blockchains.
North Korean hackers have been blamed for a massive breach at Binance, the world’s largest cryptocurrency exchange, after security researchers said at least $6.3 billion in crypto was stolen from the company’s wallets. About half of that amount was later frozen as the funds moved across different blockchains, but the full scope of the theft is still not settled. The case is drawing intense attention not just because of the number involved, but because of what it suggests about security at one of crypto’s biggest platforms. Binance says user funds are safe, though it has not yet provided proof to back that up.
Binance says a compromised laptop opened the door
In a post on X, Binance said its initial investigation showed the attackers got into the company’s network after targeting a “compromised” laptop belonging to one of its engineers. According to the exchange, that access “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”
Binance said it has seen no evidence that its private keys were leaked. Those keys would give an attacker broad control over crypto holdings, so the company’s statement suggests the breach may have happened through another route.
The exchange said it has suspended all deposits and withdrawals while the investigation continues. TechCrunch reported on Thursday that withdrawals had already been paused across some blockchains.
Roughly half of the stolen crypto was frozen
Security researchers said roughly half of the stolen crypto was frozen as it moved through various blockchains. Binance spokesperson Andie Cooper said in a statement shared with TechCrunch on Friday that some $3 billion has been frozen by industry partners.
Cooper said Binance has “begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.”
The company also said it will publish an updated proof of reserves once remediation is complete. That is intended to reassure users about the exchange’s holdings, but Binance did not immediately provide evidence to support its claim that customer funds remain safe. As IT-PUB News notes, the company is still investigating while the final scale of the theft remains unsettled.
Researchers tie the attack to TraderTraitor
The breach was attributed to North Korean hackers by security researchers at TRM Labs, a blockchain intelligence and forensic company. TRM called it the “largest hack in history.”
Researchers said the network behind the attack, known in the cybersecurity industry as TraderTraitor, is a North Korean cell focused almost entirely on stealing crypto from large companies and exchanges. TRM also said the group was responsible for the previously second-largest crypto theft on record, a $1.4 billion hack of crypto exchange Bybit in 2025.
According to TRM, the Binance theft took about 20 minutes.
Blockchain security firm Elliptic also attributed the attack to North Korean hackers. Elliptic said some of the stolen funds ended up in the same wallet used in a previous cyberattack on crypto exchange Bitget earlier this year, when hackers stole $351 million.
The breach raises hard questions for Binance
The size of the theft is what makes this case stand out, but the broader concern is operational as much as financial. Binance is the world’s largest crypto exchange, so a breach there quickly becomes a test of trust for customers who rely on it to store and move digital assets.
The incident also points to a familiar weakness in cyberattacks: a compromised employee device. The source text notes that such incidents are not unusual and can stem from compromised software on staff computers, including tampered open-source components or malware hidden inside ordinary-looking apps and games.
That matters because attackers do not always need to break through a company’s strongest outer defenses. If they can steal usernames, passwords, or session tokens from one infected laptop, they may be able to log in as a legitimate employee and reach systems that should be much harder to access.
For Binance, the unanswered question is why a single employee’s laptop could reach systems able to control such large sums. The company has not responded to questions about the breach, and TechCrunch also asked whether any third-party security audit had been done before the attack. It remains unclear whether Binance had sought such a review.
A long-running threat with unusually large stakes
The attribution to North Korea fits a pattern that security researchers and governments have warned about for years. The source text says the U.S. government and its allies have long described North Korea as a major cyber threat, with researchers saying the country’s main motive is to steal crypto to support its sanctioned weapons program.
What stands out here is not just who is accused, but how quickly the theft appears to have happened and how much money was involved. If the current estimate holds, it would be the largest known crypto theft in history.
The total could still change, and the incident is not yet resolved. Binance says it is still investigating, while researchers and industry partners continue tracing and freezing funds. For users and the wider crypto market, that leaves a difficult reality in view: digital assets can move across networks in minutes, and once they are stolen, recovery depends heavily on how fast the rest of the industry can respond.
