Binance absorbs record $6.3B North Korean heist, freezes half of stolen assets

Key points

• Binance confirmed a breach leading to the theft of approximately $6.3 billion, the largest cryptocurrency heist on record.
• The exchange has frozen roughly $3 billion in assets and pledged to cover all user losses, with withdrawals suspended pending investigation.
• Blockchain firms TRM Labs and Chainalysis attribute the attack to North Korea's TraderTraitor unit with high confidence.
• The theft occurred over approximately 20 minutes across ten blockchains, including Ethereum, Bitcoin, Tron, and Solana.
• Binance initially cited a compromised laptop but later identified additional points of breach, denying any private key leak.

Background

This incident follows a pattern of North Korean cyber operations targeting cryptocurrency exchanges to generate foreign currency amid UN sanctions. In February 2025, the Bybit exchange suffered a $1.5 billion hack attributed to the same group. Previous coverage noted that Binance co-founder Changpeng Zhao publicly addressed the hack, assuring users that their funds were safe despite the breach. The current incident has intensified concerns about the security of centralized exchanges and the sophistication of state-sponsored hacking groups.

How outlets are covering it

AP News and WIRED both report on the $6.3 billion theft and the attribution to North Korean hackers, but they differ in the depth of technical analysis. AP News focuses on the official statements from Binance and the general attribution by blockchain firms, noting that Binance is working with law enforcement to confirm the identity of the criminals. WIRED provides a more detailed breakdown of the attack's mechanics, highlighting that the theft was executed in about 20 minutes and that preparation began 36 hours prior. WIRED also notes that while $3 billion has been frozen, the remaining $3.3 billion is mostly in assets like Bitcoin and Ether that cannot be easily frozen, suggesting that the full impact of the theft may not be contained. Both sources agree that the attack bears the hallmarks of TraderTraitor, but WIRED emphasizes the difficulty in tracking the unfrozen funds, while AP News focuses on the exchange's response and the potential for recovery.

Why it matters

The breach underscores the persistent risk of large-scale cyberattacks on centralized cryptocurrency exchanges, which hold significant user assets. The attribution to North Korean hackers highlights the geopolitical dimensions of cybercrime, as state-sponsored groups use digital theft to circumvent sanctions and fund national programs. The incident also raises questions about the security protocols of major exchanges, particularly regarding the management of hot wallets and approval controls. For the broader cryptocurrency market, the event may influence regulatory scrutiny and the development of more robust security measures to prevent similar breaches in the future.

What to watch

Binance is expected to resume withdrawals within the next day or two as its investigation continues. The exchange plans to release more technical details about the breach once its probe is complete. Law enforcement agencies, including the FBI, are likely to investigate the incident further, potentially leading to the identification and prosecution of the hackers. The cryptocurrency market may experience volatility as the full extent of the theft and the recovery of assets becomes clearer. Additionally, the incident may prompt a broader review of security practices across the industry, with a focus on improving the protection of hot wallets and other critical infrastructure.