North Korean hackers steal $6,3 billion from Binance
Binance estimated the scale of the hack at about $6,3 billion and said it had frozen around $3 billion. Analysts at TRM Labs and Chainalysis link the attack to the North Korean group TraderTraitor, while the exchange’s preliminary investigation points to a breach of an employee’s laptop.
According to TRM Labs, on October 29 attackers withdrew about $6,36 billion from Binance wallets across ten blockchains. Most of the assets were stolen in about 20 minutes, starting at 20:05 UTC. Analysts call it the largest theft in cryptocurrency history: the amount is about four times the losses from the Bybit hack in February 2025.
Who is suspected of the attack
TRM Labs attributes the hack with high confidence to TraderTraitor, a North Korean hacking unit linked to Lazarus. The company cites a combination of blockchain data and other sources.
Lazarus is directly linked to North Korean state bodies. The U.S. Treasury Department classifies the group as an organization controlled by the North Korean government through the Reconnaissance General Bureau (RGB), the country’s intelligence service.
The authorities of the United States, Japan and South Korea view cryptocurrency thefts by North Korean hackers as a source of illicit revenue to fund weapons of mass destruction and ballistic missile programs. However, the intended use of the funds stolen specifically from Binance has not yet been established.
Chainalysis co-founder and CEO Jonathan Levin also named TraderTraitor as the likely organizer of the attack. Binance has yet to announce its own conclusions about the attackers’ identity and is continuing to work with law enforcement.
How Binance was hacked
According to the exchange’s preliminary assessment, the attackers may have gained access to a DevOps engineer’s laptop. From there, they infiltrated a service container and sent unauthorized withdrawal transactions.
Binance found no evidence that wallet private keys had been leaked. The company’s initial assessment therefore points to a compromise of the internal infrastructure used to carry out withdrawals. The exact mechanics of the attack are still to be determined.
The exchange revoked authorization for the affected address and temporarily suspended deposits and withdrawals until security checks were complete. Binance says it will publish a detailed technical report after the investigation is finished.
What will happen to customers’ funds
Working with partners, Binance managed to freeze assets worth about $3 billion on the blockchains. The company is continuing to track the remaining funds and is working with token issuers, analytics firms and law enforcement on additional freezes and asset recovery.
The funds that have not been frozen cannot yet be considered permanently lost: efforts to locate them are ongoing. Freezing assets restricts their movement, but does not in itself mean they have been returned to the exchange.
Binance said it would cover all losses using its SAFU reserve fund and its own funds. The company assured users that their assets were safe and promised to publish an updated Proof of Reserves after recovery work is complete.
