North Korean Hackers Suspected in Record USD 6.3 Billion Binance Heist

US-based blockchain intelligence firms TRM Labs and Chainalysis have linked North Korea's elite hacking unit, TraderTraitor, to a massive cryptocurrency theft involving approximately USD 6.3 billion from Binance, the world's largest cryptocurrency exchange. The incident, which affected wallets across 10 blockchain networks, is being described as the largest cryptocurrency theft on record, surpassing the USD 1.5 billion Bybit hack of February 2025. Investigators said most of the stolen assets were transferred within approximately 20 minutes, raising serious concerns about cryptocurrency exchange security and increasingly sophisticated state-linked cyberattacks.

According to TRM Labs, approximately USD 6.36 billion was transferred across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. The firm attributed the attack to TraderTraitor with high confidence, citing similarities with previous North Korean-linked operations. Chainalysis independently supported the assessment.

Binance's preliminary investigation indicated that a compromised laptop belonging to a DevOps engineer may have provided attackers access to an internal service container, enabling unauthorised withdrawal transactions. TRM identified the exploitation of Ethereum's EIP-7702 delegation mechanism, which allegedly allowed attackers to automate transfers from a compromised hot wallet. Investigators also identified approximately 50 pre-signed authorisations prepared in advance. However, Binance maintained that it had found no evidence of a private-key leak.

The exchange revoked the affected authorisation, temporarily restricted withdrawals and coordinated with law enforcement and blockchain partners. Binance initially reported that approximately USD 3 billion in assets had been frozen. TRM separately estimated that around USD 2.67 billion had been frozen through interventions involving Tether, Circle, Ripple and blockchain authorities, including Arbitrum's Security Council. Attackers reportedly attempted to move remaining assets through decentralised exchanges, market makers and lending platforms such as Aave and JustLend.

Binance assured customers that all losses would be covered, arranging approximately USD 6.34 billion in company resources and customer-protection funds. Founder Changpeng Zhao, popularly known as CZ, also assured users that their funds were safe.

The attack has renewed concerns over North Korea's cryptocurrency theft operations. The FBI previously attributed the USD 1.5 billion Bybit hack in February 2025 to TraderTraitor. South Korea's intelligence agency had earlier estimated that North Korean hackers stole approximately 1.5 trillion won (USD 1.1 billion) in virtual assets over five years.