Security researchers have pinned the Binance hack on North Korea. They say state-backed hackers stole at least $6.3 billion in crypto from the exchange’s wallets, the largest known crypto theft on record. Roughly half of that amount was frozen as the funds moved across different blockchains.
The total may still change. Binance has not declared the incident resolved, and investigators are still tracing where the money went. For context, the previous record was the $1.4 billion theft from Bybit in 2025, which the same group is blamed for.
How the Binance hack started
In a post on X, Binance said its early findings point to a single entry point. Attackers targeted a “compromised” Binance engineer’s laptop, which “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”
Binance says it has seen no evidence that its private keys leaked. Those keys would give an attacker near-total control over the company’s crypto reserves. Still, the exchange has suspended all deposits and withdrawals while the investigation continues. A day earlier, TechCrunch had reported that withdrawals were paused on some of its blockchains.
The company also says “user funds are safe,” but it has not yet backed that claim with evidence. Instead, it plans to “publish an updated proof of reserves once the remediation is complete.”
About $3 billion frozen so far
Binance spokesperson Andie Cooper told TechCrunch that industry partners have frozen some $3 billion. According to Cooper, Binance has “begun recovering affected assets for users” and is working with law enforcement, token issuers and blockchain intelligence firms to trace and freeze more of the stolen funds.
It is unclear how the engineer’s laptop was compromised in the first place. Breaches like this often start with tampered software on employee devices. Attackers regularly modify open source components to steal data, and malware hidden inside ordinary-looking apps and games can lift passwords and session tokens. With those, an intruder can log in as a legitimate employee.
As a result, the Binance hack raises questions about why one laptop could reach systems that control billions of dollars. The company did not answer TechCrunch’s questions about whether a third-party firm audited its network before the attack.
TraderTraitor linked to the Binance hack
Blockchain forensics firm TRM Labs attributed the breach to North Korean hackers and called it the “largest hack in history.” TRM says the theft took about 20 minutes.
Researchers tie the Binance hack to a group known as TraderTraitor. The cell focuses almost entirely on stealing crypto from large companies and exchanges. Meanwhile, blockchain security firm Elliptic reached the same conclusion. It found that some of the stolen funds landed in a wallet used earlier this year in the attack on Bitget, where hackers took $351 million.
The United States and its allies have warned about North Korea’s crypto theft for years. The country remains cut off from the global financial system over its nuclear weapons program. Researchers say North Korea uses stolen crypto to fund that sanctioned weapons development.
For now, Binance deposits and withdrawals stay frozen until the exchange completes its remediation and publishes new proof of reserves.