Binance 6 3 Billion Hack North Korea

Cryptocurrency exchange Binance suffered a record $6.3 billion cyberattack linked to North Korean state-backed hackers late on Thursday evening. The company committed to fully covering user losses as forensic teams and law enforcement agencies work to trace and recover the stolen digital assets.

The security breach is widely considered the largest heist in history, surpassing both a $1.5 billion cryptocurrency raid last year and the $1 billion stolen from Iraq's central bank in 2003. Security analysts from TRM Labs, Chainalysis, and Elliptic identified the North Korean cyber unit known as TraderTraitor or Lazarus Group as the primary culprit behind the operation. Investigators noted that the hackers used unprecedented automated laundering patterns, repeatedly circulating funds between wallet addresses to confuse tracking systems. Rather than relying solely on traditional crypto mixers, the attackers quickly transferred large volumes of digital assets across the Tron blockchain network.

Binance initially suspected that an engineer's laptop had been compromised, enabling unauthorized transactions from its systems. However, co-chief executive officer Richard Teng later confirmed that subsequent investigations uncovered additional breach points across the exchange's network infrastructure. Attackers managed to exploit special authorizations within Binance's hot wallet signing system, turning an internet-connected wallet into an automated transfer hub. Cybersecurity experts noted that threat actors may have leveraged artificial intelligence tools to automate the intrusion and orchestrate complex post-exploitation movements, BBC reported.

In response to the incident, Binance temporarily suspended all deposits and withdrawals while internal security teams worked with international law enforcement. Teng publicly assured customers that their money remained safe and confirmed that the platform set aside $6.34 billion to cover all missing funds. Former Binance chief executive Changpeng Zhao also reiterated on social media platform X that user assets would be fully protected. A spokesperson for the exchange confirmed that approximately 80 percent of the compromised assets had been secured during initial containment efforts.

Race to Freeze Assets

Blockchain firms and stablecoin issuers swiftly took action to prevent the stolen funds from being converted into conventional fiat currency. Tether moved to freeze nearly $1.57 billion in USDT linked to the attack, while Circle froze more than $800 million in USDC. Crypto business World Liberty Financial also collaborated with custodian BitGo to lock down compromised funds. Stablecoin issuers have the technical capability to burn frozen tokens and reissue replacement assets to help Binance recover its losses, CNBC reported.

Despite those freezing efforts, the cybercriminals executed counter-maneuvers to bypass asset locks and preserve their illicit gains. The hackers traded USDT tokens to market makers and borrowed ether against the stablecoins, effectively shifting the risk to lending entities while securing assets that cannot be frozen easily. Ethereum suffered the largest individual financial impact in the attack, with roughly $3.8 billion worth of ether affected. Investigators highlighted that the group is increasingly relying on professional Chinese money laundering organizations that purchase stolen crypto over the counter for hefty fees before converting it off-chain into hard currency.

The sudden revelation of the cyberattack triggered immediate volatility across broader digital asset markets during early Asian trading. Bitcoin dropped five percent to $77,380, hitting its lowest valuation level in six weeks. The market decline added further pressure to a digital asset sector already dealing with high interest rates in the United States and muted demand from exchange-traded funds. Meanwhile, Binance.US clarified that its separate platform was completely unaffected by the security breach, as reported by The Guardian.

Background

According to blockchain intelligence estimates, North Korea has stolen more than $6.5 billion in digital assets over recent years, including over $1 billion within 2026 alone. North Korean state-backed hacking groups have systematically targeted the cryptocurrency sector for years to generate revenue under severe international sanctions. The regime reportedly recruits top university talent into specialized cyber units supervised by national intelligence agencies. Federal law enforcement agencies, including the Federal Bureau of Investigation, previously blamed TraderTraitor for a $1.5 billion heist on the Bybit exchange, where stolen funds were rapidly laundered into bitcoin.

Binance stands as the world's largest cryptocurrency exchange, managing approximately $162.8 billion in assets under custody and serving 335 million registered global users. The company was founded by Changpeng Zhao, who served four months in prison in 2024 following a guilty plea to federal money laundering violations before receiving a pardon from Donald Trump in 2025. International law enforcement agencies, including the Secret Service and the FBI, are assisting Binance with asset tracing efforts, while financial regulators such as the United Kingdom's Financial Conduct Authority monitor potential systemic risks across connected financial institutions.

Why It Matters

This unprecedented security breach underscores the escalating technical sophistication of state-sponsored cybercriminals and their ability to compromise critical digital asset infrastructure. The incident may prompt institutional investors to reassess risk management protocols and lead regulatory authorities to impose stricter oversight on centralized exchanges.

Illustration: AI-generated image, not a photograph of the event.