North Korea Linked To $6.3 Billion Binance Hack In Biggest Crypto Heist Ever

Over six billion dollars have been stolen in crypto funds from Binance, in what analysts suggest could be the largest-ever heist of virtual currencies. Behind the hack could be an entity in North Korea, two blockchain analysts have claimed.

The US-based blockchain investigation firm TRM Labs has expressed "high confidence" that TradeTraitor, a hacker group affiliated with North Korea, was behind the attack.

"TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on- and off-chain intelligence. We make this judgment with high confidence," it said, adding that several features of this attack match earlier North Korea-linked heists.

Chainalysis, a blockchain analysis company, also believed that TradeTraitor was likely behind the hack.

"We live in unprecedented times. But DPRK are up to their old tricks. We assess Binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack," the company's co-founder Jonathan Levin wrote on X.

DPRK refers to the Democratic People's Republic of Korea, the official name of North Korea.

Binance Wallets Cleared Of $6 Billion

Binance, the world's largest cryptocurrency exchange, has described the hack as a "complex attack" on its $6.34 billion funds and said it was working with its blockchain partners to freeze around $3 billion in affected assets. It also assured that efforts are underway to recover the assets of the users.

"Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms, and industry partners to trace, freeze, and recover additional funds," a statement said.

The platform added it has already reserved over $6.34 billion of company funds to cover the incident, of which $5 billion is held in the same token assets that were impacted.

Describing the hack, TRM said that an attacker had moved about USD 6.36 billion out of Binance wallets on 10 blockchains. Most of the funds were moved out within about 20 minutes, it added, describing it as the largest cryptocurrency theft on record.

North Korea And Crypto Heists

Believed to be part of Lazarus Group, TraderTraitor is one of the elite hacking units linked to North Korea. In 2014, the group was accused of hacking into Sony Pictures to avenge the making of 'The Interview', a film that mocked North Korea's Kim Jong Un.

Over a decade later, in February 2025, the FBI held TradeTraitor responsible after the Bybit crypto exchange suffered a hacking and a $1.5 billion hit. when it was hacked.

TRM Labs said that several features of the Binance attack match earlier North Korea-linked heists, including the Bybit hack. "That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025," the company said while commenting on the Binance hack.

Reports of the hack sent shockwaves through the crypto industry, with Bitcoin tumbling 4% to USD 77,465. Many other major crypto tokens also tanked after reports of the cyberattack. Bitcoin and Ethereum plunged about 5% and 6%, respectively.