North Korea's TraderTraitor Unit Blamed for Record $6.3 Billion Binance Hack
North Korea’s TraderTraitor Unit Blamed for Record $6.3 Billion Binance Hack #
Binance, the world’s largest cryptocurrency exchange, has been hit by the biggest crypto theft in history, with North Korean state-linked hackers draining approximately $6.3 billion from the platform’s wallets in an attack that lasted barely 20 minutes, according to blockchain intelligence firms.
Security researchers at TRM Labs attributed the breach to TraderTraitor, a North Korean hacking cell with a long track record of targeting crypto firms, saying they made the assessment “with high confidence.” Blockchain security firm Elliptic independently reached the same conclusion, and the FBI later confirmed North Korea’s involvement. The theft surpasses the previous record, a $1.4 billion raid on rival exchange Bybit in 2025, also attributed to TraderTraitor.
According to Binance’s own account posted on X, attackers first compromised a Binance engineer’s laptop, which gave them access to a service container and enabled them to submit unauthorized withdrawal transactions. The exchange said it found no evidence that its private keys, which would have granted attackers far broader control over stored crypto, were exposed, though a subsequent investigation identified multiple additional “points of breach” beyond the initial entry point.
Binance suspended withdrawals as the investigation unfolded and said deposits remained unaffected throughout. Working with exchanges, blockchain intelligence firms, and law enforcement, the company said it managed to freeze around $3 billion of the stolen funds as they moved across various blockchains, with that figure later revised upward to $5 billion. The exchange pledged to cover all user losses and said it would publish an updated proof of reserves once remediation is complete.
Elliptic noted that some of the stolen assets appeared in the same wallet used in an earlier attack on crypto exchange Bitget, in which $351 million was taken, reinforcing the attribution to the same North Korean network. Researchers describe TraderTraitor as operating almost exclusively to siphon crypto to fund Pyongyang’s sanctioned weapons programmes.
The breach raises questions about Binance’s internal security architecture, particularly how a single compromised employee device could enable access to systems controlling billions of dollars in customer funds. Binance had not responded to questions about whether independent security audits of its network were conducted prior to the attack.
Copy link