North Korea TraderTraitor: $6.3 Billion Binance Hack Attributed by TRM

• A U.S. blockchain intelligence firm, TRM, attributes a hack impacting over $6 billion on Binance to North Korea's elite hacking unit, TraderTraitor.
• Approximately $6.36 billion was moved from Binance wallets across ten blockchains, mostly within 20 minutes, potentially making it the largest cryptocurrency theft on record.
• Binance has frozen about $3 billion of the affected assets and committed to covering all user losses, despite initial findings suggesting a compromised laptop and subsequent "points of breach."
• Blockchain analysis firm Chainalysis also linked the incident to the DPRK group TraderTraitor, highlighting a pattern of state-sponsored cybercrime used by North Korea to fund its economy and nuclear program.
• The incident raises questions about Binance's security controls, though the company denies any private key leak and founder Changpeng Zhao expects all user funds to be fully covered.

This event marks what could be the largest cryptocurrency theft ever recorded, as approximately $6.36 billion was siphoned from Binance wallets across ten different blockchains, with the majority of the funds moved in a mere 20 minutes.

A major cryptocurrency exchange, Binance, recently experienced a significant security breach, with a U.S.-based blockchain intelligence firm, TRM, attributing the incident to a North Korean hacking unit. The firm stated with high confidence that the attack, which impacted over $6 billion, was carried out by TraderTraitor, identified as North Korea's elite hacking group. This event marks what could be the largest cryptocurrency theft ever recorded, as approximately $6.36 billion was siphoned from Binance wallets across ten different blockchains, with the majority of the funds moved in a mere 20 minutes.

Binance, recognized as the world's largest cryptocurrency exchange, has confirmed the security incident. Following the breach, the company collaborated with its blockchain partners, successfully freezing around $3 billion of the stolen assets. The exchange also announced its efforts to recover assets for affected users, assuring the public that customer deposits remained secure. While withdrawals were temporarily suspended, Binance indicated they were expected to resume within one to two days and pledged to cover all user losses resulting from the incident.

Initial investigations by Binance suggested a compromised laptop might have been involved in the breach. However, subsequent inquiries revealed additional "points of breach," indicating a more complex attack vector. Another prominent blockchain analysis company, Chainalysis, through its co-founder and CEO Jonathan Levin, echoed TRM's assessment, stating that the hack was "likely done by DPRK group TraderTraitor." The Democratic People’s Republic of Korea (DPRK) is the official name for North Korea.

The attribution of this massive cryptocurrency exchange security breach to North Korea's TraderTraitor unit aligns with a pattern of state-sponsored cybercrime. Experts widely believe that North Korea increasingly relies on illicit cyber activities, including crypto hacking, to generate much-needed foreign currency. This revenue stream is crucial for sustaining its struggling economy and funding its nuclear program, particularly in the face of stringent U.N. sanctions and other economic challenges.

This incident bears striking similarities to previous North Korea-linked heists. For instance, TRM highlighted that several features of the Binance attack mirrored those seen in the Bybit hack, another cryptocurrency exchange that suffered a $1.5 billion loss in February of the previous year. The FBI had previously identified North Korea and TraderTraitor as responsible for the Bybit breach. Further underscoring the scale of DPRK state-sponsored cybercrime, South Korea’s spy agency reported in December 2022 that North Korean hackers had stolen an estimated 1.5 trillion won, equivalent to $1.1 billion, in cryptocurrency and other virtual assets over the preceding five years, with more than half of that amount stolen in 2022 alone. The agency also noted North Korea's digital asset theft capabilities are considered among the best globally.

The scale of the Binance $6.3 billion crypto theft has inevitably raised significant questions regarding the cryptocurrency exchange's security protocols and internal controls. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, expressed concerns about the apparent lack of robust approval mechanisms, suggesting the attack might have exploited a vulnerability akin to "one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet." Hot wallets are internet-connected cryptocurrency wallets that store users' private keys digitally. Binance, however, stated on X that its investigation had found "no evidence of any wallet private key leak" and promised to release further technical details once its probe concludes.

Despite no longer managing Binance, its founder, Changpeng Zhao (CZ), who established the platform in 2017, commented on the incident. Zhao, who pleaded guilty in 2023 to a felony related to failing to prevent money laundering on the platform and subsequently stepped down as CEO, was reportedly pardoned by U.S. President Donald Trump in 2025. He posted on X, reassuring users that "User funds are safe!" while acknowledging that the event "does look like a hack on Binance." As a shareholder, Zhao publicly stated his expectation that all user funds would be fully covered, reinforcing Binance's commitment to its users.

Compliance officers and legal counsel for financial institutions and cryptocurrency platforms must reassess their cybersecurity frameworks, sanctions compliance protocols, and asset recovery strategies in light of sophisticated state-sponsored cyberattacks like the alleged North Korean hack on Binance. This incident highlights the critical need to mitigate risks associated with illicit financing, potential liability for customer losses, and regulatory reporting obligations following such large-scale breaches.

Source: Facts derived from AP reporting.