North Korean Hackers Blamed for Record $6.3 Billion Binance Theft

Hackers working for the North Korean regime stole at least $6.3 billion in cryptocurrency from Binance, according to security researchers at TRM Labs — the largest known crypto theft in history, roughly 4.5 times the previous record. About half of the stolen amount was frozen as the funds moved across various blockchains, TRM said. The breach has not been confirmed as resolved, and the final stolen figure may change.

Binance, the world's largest crypto exchange, said in a post on X that its initial investigation found the attackers broke in through a "compromised" Binance engineer's laptop, which "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." The company said it has seen no evidence that its private keys leaked — the worst-case scenario that would grant a hacker near-unfettered control over its crypto stores. No evidence, however, is not proof of safety.

According to TRM Labs, a blockchain intelligence and forensics company, the entire theft took about 20 minutes. That pace works out to roughly $315 million per minute, or about $5.2 million every second.

Who is behind the attack?

TRM Labs attributed the breach to a North Korean hacking cell the cybersecurity industry calls TraderTraitor, describing it as a group focused almost exclusively on stealing crypto from large companies and exchanges. The same group was blamed for the $1.4 billion theft from crypto exchange Bybit in 2025 — previously the largest heist on record, now second place by a wide margin.

Blockchain security firm Elliptic reached the same attribution independently. Elliptic said some of the stolen funds landed in the same wallet used in an earlier attack on crypto exchange Bitget this year, in which hackers made off with $351 million. The wallet overlap gives investigators a concrete thread to pull.

Researchers say North Korea's motivation is singular: steal as much crypto as possible to fund its sanctioned weapons of mass destruction programs. The U.S. government and its allies have long warned about this threat from a state cut off from the American and global financial systems over its nuclear weapons development.

What has Binance actually confirmed?

Binance has suspended all deposits and withdrawals while its investigation continues. TechCrunch reported on Thursday that the exchange had already paused withdrawals across some of its blockchains.

The company said "user funds are safe," but did not immediately provide proof of that claim. It promised to "publish an updated proof of reserves once the remediation is complete." Until that proof arrives, the assurance rests on Binance's word alone.

It remains unclear exactly how the hack unfolded or how the employee's laptop was compromised. Such incidents often stem from compromised software on employee devices. Software is typically built from many components, including open-source projects, which hackers regularly target and modify to steal data. Malware bundled with ordinary-looking apps and games can also harvest usernames, passwords and session tokens — sometimes enough to log in as a legitimate employee.

What questions remain unanswered?

Binance will face hard questions about why a single employee's laptop could access systems controlling billions of dollars in funds. Binance spokespeople did not respond to a request for comment on the hack.

TechCrunch has also asked whether anyone performed a security audit of Binance's network and systems before the breach. Companies routinely hire third parties to stress-test their defenses and identify weaknesses attackers could exploit. It is unclear whether Binance ever sought such a review. That silence is itself part of the story.

The takeaway in plain words: the world's largest exchange lost a record sum in 20 minutes through one laptop, and the central claims — that user funds are safe and the incident is contained — still lack public proof.

Regulators, auditors and institutional clients will now demand answers Binance has so far declined to give; whether it publishes that proof of reserves on schedule may determine how much of the market believes its version of events.