Binance to cover $6.3 billion loss after North Korean hackers drain wallets

A North Korean hacking unit drained more than $6 billion from the world's largest cryptocurrency exchange.

Binance confirmed on Friday that it is beginning to recover assets for its users. The company stated that deposits remained unaffected during the incident. However, withdrawals are currently suspended. The exchange expects to resume withdrawals within the next day or two. It pledged to cover all losses incurred by users.

TRM, a U.S.-based blockchain intelligence firm, attributed the attack to a group known as TraderTraitor. The firm described TraderTraitor as North Korea's elite hacking unit. TRM stated it made this judgment with high confidence. According to TRM, an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains. Most of the funds moved in about 20 minutes. This amount would make the event the largest cryptocurrency theft on record.

Binance said an initial investigation suggested the incident involved a compromised laptop. A subsequent review uncovered additional points of breach. The company posted on X that it found no evidence of any wallet private key leak. It plans to release more technical details when its probe is complete.

Chainalysis, another blockchain analysis company, agreed with the North Korean attribution. Co-founder and CEO Jonathan Levin wrote on X that the hack was likely done by the DPRK group TraderTraitor. The DPRK is the official name for North Korea.

A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice. The exchange did not confirm the specific attribution to North Korea in that statement.

Experts note that North Korea has turned to crypto hacking to obtain foreign currency. These funds support the country's economy and its nuclear program in the face of U.N. sanctions. In December 2022, South Korea's spy agency reported that North Korean hackers stole an estimated 1.5 trillion won in the past five years. More than half of that sum was taken in 2022 alone.

Changpeng Zhao, the founder of Binance, posted on X on Thursday that user funds are safe. Zhao admitted the event looks like a hack on the platform. He added that as a shareholder, he expects all user funds to be fully covered. Zhao stepped down as CEO in 2023 after pleading guilty to a felony related to money laundering. U.S. President Donald Trump pardoned him in 2025.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the event raises questions about approval controls. He explained that one signature gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold private keys that are connected to the internet. This single token allowed the attacker to move funds without standard verification checks.