Binance Hack Costs $6.36 Billion, Largest Crypto Theft on Record

An attacker drained approximately $6.36 billion from Binance wallets across ten blockchains, according to blockchain intelligence firm TRM. The theft occurred in roughly 20 minutes and stands as the largest cryptocurrency heist in history. TRM attributed the attack to TraderTraitor, a hacking unit it identifies as belonging to North Korea.

TRM stated it makes this attribution with high confidence. The firm noted that several features of the attack match earlier North Korea-linked heists, including a $1.5 billion hack on the exchange Bybit in February 2025. The FBI previously confirmed North Korean involvement in the Bybit incident. Chainalysis, another blockchain analysis company, reached a similar conclusion. Its co-founder and CEO, Jonathan Levin, wrote on X that the Binance hack was likely done by the DPRK group TraderTraitor.

Binance announced on Friday that it is beginning to recover assets for users. The company stated that deposits were unaffected, but withdrawals have been suspended. Binance expects to resume withdrawals in the next day or two. It confirmed that it will cover all losses from the incident. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

The exchange reported that an initial investigation suggested the incident involved a compromised laptop. A subsequent review uncovered additional points of breach. Binance said it found no evidence of any wallet private key leak. The company plans to release more technical details when its probe is complete. Changpeng Zhao, who founded Binance in 2017, posted on X that user funds are safe. He added that the theft looks like a hack and that, as a shareholder, he expects all user funds to be fully covered.

Cybersecurity experts point to specific technical failures in the attack. Kok Tin Gan, cofounder and CEO of NyxLab, said the incident appears to involve a single signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys and are connected to the internet. Gan noted that this setup raises questions about why stronger approval controls were not in place.

North Korea has increasingly relied on cryptocurrency hacking to generate foreign currency. Experts say the funds support the country's economy and nuclear program in the face of U.N. sanctions. In December 2022, South Korea's spy agency reported that North Korean hackers stole an estimated 1.5 trillion won, or $1.1 billion, in digital assets over five years. More than half of that total was stolen in 2022 alone. The agency described North Korea's capacity to steal digital assets as among the best in the world.

Zhao pleaded guilty to a felony in 2023 related to failing to prevent money laundering on the platform. He stepped down as CEO at that time. President Donald Trump granted Zhao a pardon in 2025. The current incident follows a pattern of high-value digital asset thefts targeting major exchanges. Binance has frozen roughly $3 billion in affected assets with the help of blockchain partners. The company continues its investigation while managing user expectations for the return of normal operations.