Binance suffers largest crypto theft in history from North Korean group

Security researchers have attributed a record cryptocurrency theft to hackers working for the North Korean regime. The attackers stole at least $6.3 billion from Binance, the world’s largest cryptocurrency exchange, though about half of that amount has been frozen as it traveled across various blockchains. The incident marks the largest known theft of cryptocurrency in history.

Binance has suspended all deposits and withdrawals while investigating the breach. According to the company’s initial findings, hackers gained access to the exchange’s network through a compromised engineer’s laptop, which allowed them to access a service container and submit unauthorized withdrawal transactions. The company stated it has found no evidence of leaked private keys, which would have given attackers more direct control over Binance’s cryptocurrency stores.

How the Attack Unfolded

The specific circumstances surrounding how the employee’s laptop became compromised remain unclear, but security researchers note that such breaches typically stem from one of several common attack vectors.

Compromised Software and Malware

Hackers frequently target open-source components used in software builds, compromising and modifying them to steal data from infected devices. Alternatively, malware bundled with seemingly legitimate applications or games can allow attackers to harvest usernames, passwords, and session tokens from compromised computers, potentially enabling them to log in with the credentials of legitimate employees.

System Access and Execution

Once the attacker gained access through the engineer’s compromised device, the execution was swift. According to blockchain intelligence firm TRM Labs, the entire theft took approximately 20 minutes to execute. The attacker submitted unauthorized withdrawal transactions from a service container, moving billions in cryptocurrency out of Binance’s wallets before security systems could detect and stop the activity.

Record-Breaking Theft and Historical Context

Read also: Binance halts withdrawals after suspected $2 billion-plus crypto theft · Alleged Chinese Spy Targeted Nvidia CEO in U.S. Investigation · Bluesky Blocks DHS Employee Data as Government Pursues Takedowns

The $6.3 billion theft stands as the largest cryptocurrency heist on record, surpassing previous major incidents. The same hacker group is blamed for the second-largest cryptocurrency theft in history: a $1.4 billion theft from crypto exchange Bybit that occurred in 2025. Additionally, security researchers found that some of the cryptocurrency stolen from Binance was moved to a wallet previously used in a cyberattack on Bitget earlier this year, in which hackers stole $351 million.

The TraderTraitor Group

Security researchers have identified the attackers as TraderTraitor, a hacker network operated by North Korea. Researchers describe the group as focused almost exclusively on stealing cryptocurrency from large companies and exchanges. TRM Labs, a blockchain intelligence and forensic company, attributed the Binance theft to this North Korean cell and called it “the largest hack in history.” Blockchain security firm Elliptic independently confirmed that North Korean hackers were responsible for the attack.

Outstanding Security Questions

The breach raises questions about Binance’s security architecture and how a single employee’s compromised laptop could provide access to systems controlling billions of dollars in cryptocurrency. The company announced that “user funds are safe” but has not yet provided proof of this claim, instead stating it will “publish an updated proof of reserves once the remediation is complete.”

Binance spokespeople have not responded to questions about how the company’s security infrastructure allowed such deep access from a single compromised device. Security experts have also questioned whether Binance conducted third-party security audits before the breach. It is standard practice for cryptocurrency exchanges and major financial firms to engage external security companies to stress-test their systems and identify vulnerabilities, but it remains unclear whether Binance sought such a review prior to this incident.

Investigation Status and the Role of Private Keys

While approximately half of the stolen cryptocurrency has been frozen as it crossed various blockchains, the investigation into the breach remains ongoing. Binance has stated it found no evidence that hackers obtained the private keys that would grant near-complete control over the company’s cryptocurrency holdings. This is significant because theft of private keys would represent a far more severe compromise than what appears to have occurred, potentially giving attackers unfettered access to all stored assets.

Instead, the attackers’ access was limited to submitting unauthorized withdrawal transactions through a service container. This suggests the breach, while enormous in scale, did not penetrate the deepest layers of Binance’s security infrastructure.

Geopolitical Context and Motivation

The attribution of the theft to North Korean hackers places the incident within a broader pattern of cyber operations targeting cryptocurrency. The U.S. government and its allies have long flagged North Korea as a significant threat actor in cyberspace, with the country remaining isolated from the global financial system due to its ongoing nuclear weapons development program.

According to security researchers, North Korea’s primary motivation in targeting cryptocurrency exchanges is to generate funds for its weapons of mass destruction programs. Crypto theft provides the sanctioned country with a means to circumvent international financial restrictions and sanctions. The scale and frequency of these attacks suggest that cryptocurrency theft has become a central component of North Korea’s strategy to fund its military ambitions.

TechCrunch first reported that Binance had paused withdrawals across some blockchains. The breach has not been fully resolved, and the final amount of stolen cryptocurrency may still change as the investigation continues.

Source: TechCrunch