North Korean Hacker Unit Suspected in $6.3 B Binance Breach
A U.S. blockchain intelligence firm links the massive Binance theft to North Korea’s alleged elite hacking group TraderTraitor.
TRM and Chainalysis point to North Korea
TRM posted on its website Thursday that the attack “was likely done by DPRK group TraderTraitor,” describing the group as North Korea’s elite hacking unit and stating it makes the judgment “with high confidence.” Chainalysis echoed the assessment in a post on X, with co‑founder and CEO Jonathan Levin also naming TraderTraitor as the probable perpetrators.
The firms say an attacker moved approximately USD 6.36 billion out of Binance wallets across ten blockchains in roughly 20 minutes, which would make it the largest cryptocurrency theft on record.
Binance’s response
Binance announced that it worked with blockchain partners to freeze roughly $3 billion of the affected assets. The exchange said on Friday that it is beginning to recover assets for users and will cover all losses.
Deposits remain unaffected, but withdrawals have been suspended and are expected to resume “in the next day or two.” The company’s X post from Thursday reassured users that “User funds are safe!” while noting that the theft “does look like a hack on Binance.”
Binance’s spokesperson said the firm is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice,” without confirming the North Korean link.
Technical clues and prior attacks
TRM noted that “several features of this attack match earlier North Korea‑linked heists, including the Bybit hack.” The Bybit incident in February of the previous year resulted in a $1.5 billion loss, which the FBI attributed to North Korea and TraderTraitor.
Both analysis firms highlighted that the initial Binance investigation suggested a compromised laptop, but a later probe uncovered additional “points of breach.”
Broader context of North Korean cyber activity
South Korea’s spy agency reported in December 2022 that North Korean hackers had stolen an estimated 1.5 trillion won (about $1.1 billion) in cryptocurrency and other virtual assets over the prior five years, with more than half taken in 2022 alone. The agency described North Korea’s capacity to steal digital assets as “among the best in the world.”
Experts cited in the source say the regime has turned to crypto hacking and other illicit cyber activities to generate foreign currency for its economy and nuclear program amid strict U.N. sanctions.
Binance leadership comments
Changpeng Zhao, founder of Binance, posted on X that he expects all user funds to be fully covered, emphasizing his role as a shareholder rather than an operator after stepping down as CEO in 2023.
While Zhao’s statement reassures investors, the incident raises questions about Binance’s security posture and the broader vulnerability of major crypto exchanges to state‑backed cyber‑crime.
