Binance Heist Linked to North Korea by Blockchain Research Firms

Binance suspended withdrawals late Thursday after hackers broke into its digital wallets and stole $6 billion in digital coins across 10 blockchains in under 30 minutes, an event reported as the largest cryptocurrency heist in history.

The New Turn at Binance

Hackers targeted the world’s largest cryptocurrency exchange via an engineer’s laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions, Binance stated late Thursday. The attack impacted only Binance corporate holdings rather than consumer accounts. Blockchain intelligence firms and cryptocurrency companies mobilized quickly to stanch the bleeding. A team of firms managed to freeze about $3 billion of the stolen loot amid a frenetic battle to control the digital money. Binance co-CEO Richard Teng stated on Friday in a statement intended to ease customers’ concerns that the attack required a complex process rather than a simple one-click action. Binance expects withdrawal services to resume by Sunday morning and has pledged to cover all losses from company funds and an emergency assets fund, maintaining that user funds remain safe.

Research Firms Link Heist to North Korean Hackers

U.S.-based blockchain research firm TRM Labs attributed the heist to an elite North Korean hacking unit called TraderTraitor, relying on detailed on- and off-chain intelligence that matches earlier North Korea-linked cyberattacks. Singapore-based blockchain-tracking firm Pangolin Intelligence also pointed to a North Korean hacking unit, noting that the perpetrators will likely tap money laundering networks to cash out the stolen assets. Chainalysis monitored stolen funds moving across multiple blockchains including bitcoin and ethereum, stating it had high confidence in North Korean responsibility. Law enforcement agencies including the FBI and the U.S. Secret Service engaged with public and private partners to trace and recover the funds.

North Korean Actors Stole Billions in Previous Attacks

The incident follows a string of major digital asset thefts linked to the same actors. In December 2022, South Korea’s spy agency accused North Korean hackers of stealing roughly $1.1 billion in virtual assets over five years. TraderTraitor subsequently stole $1.5 billion from Bybit in February 2025, according to the FBI, before attackers took around $350 million from Bitget last month. Former South Korean Vice Defense Minister Shin Beom-chul told the Financial Times that North Korean hackers remain among the world’s most aggressive and skilled cyber actors, noting that Pyongyang’s hackers stole about $2 billion last year alone. The heist also lands against a backdrop of shifting U.S. crypto policy. In June 2024, Donald Trump vowed to make the United States the crypto capital of the planet, focusing his second term on reducing aggressive oversight of the industry.

Market Response

Cryptocurrency markets reacted immediately to the breach. Bitcoin’s value dropped more than 5 percent overnight from Thursday into Friday, while other cryptocurrency exchanges fell as much as 9 percent. TRM Labs estimated that the hackers successfully moved roughly $2.4 billion in crypto coins beyond any issuer’s reach before security measures took hold. Binance announced it is working closely with law enforcement partners to confirm the criminals’ identities and bring them to justice as tracing efforts continue across multiple blockchain networks.

More on this story: Binance Suffers Security Breach Involving Digital Assets · US Treasury Sanctions North Korea Network for Scamming US Firms

More on North Korea: North Korea Breached South Korean Lines in Simulation: Business AM · North Korea Denies Rumors That Kim Jong-un Is in a Coma · South Korea: North Korea Fires Multiple Missiles Into Sea of Japan