Skip to main content
BitCurrent

Crypto markets, protocols and policy

Analysts link $6.36B Binance hack to North Korea

TRM and Chainalysis attribute Binance’s $6.36 billion theft to North Korea-linked TraderTraitor, while the exchange says its probe is ongoing and users will be covered.

BitCurrent Newsroom2 min read

Analysts link $6.36B Binance hack to North Korea

Binance is investigating a major breach across its crypto wallets. Blockchain intelligence firms say North Korea’s TraderTraitor unit likely carried out the theft, which the exchange estimates affected $6.3 billion.

  • TRM said about $6.36 billion moved from Binance wallets across 10 blockchains.
  • Most of the funds moved in about 20 minutes, according to TRM.
  • Binance said it worked with partners to freeze roughly $3 billion in affected assets.

The Associated Press reported that TRM made its attribution with “high confidence.” Chainalysis also assessed the breach as likely the work of TraderTraitor, according to AP. The FBI previously attributed the 2025 Bybit hack to North Korea and the same unit.

What evidence links the attack to North Korea?

TRM said the attack shared features with earlier North Korea-linked thefts, including the Bybit breach. The firm’s attribution is an intelligence assessment, not an official government finding.

Elliptic said its analysis found that some Binance theft proceeds reached an address that also received funds from a suspected North Korea-linked Bitget exploit. It cautioned that the overlap was small and does not prove the same actors were behind both incidents.

What has Binance confirmed about the breach?

Binance said its initial investigation pointed to a possibly compromised laptop, but a later update identified additional “points of breach.” The exchange has not yet explained what those points were.

The company said deposits were unaffected, withdrawals were suspended, and it would cover all losses. It said withdrawals were expected to resume within a day or two, according to AP.

Is responsibility established?

No government or law enforcement agency has publicly confirmed who carried out the attack. Binance said it was working with law enforcement to identify the criminals, while its technical investigation continues.

The scale of the theft and the amount frozen are reported figures that may change as firms trace funds. The attribution remains provisional until investigators establish who controlled the wallets and systems used in the breach.

Source material