North Korean hackers have been blamed for a massive cyberattack on Binance, the world’s largest cryptocurrency exchange, resulting in the theft of approximately $6.3 billion in digital assets.

Security researchers said nearly half of the stolen funds had been frozen by industry partners as the attackers moved the assets across different blockchain networks.

If confirmed, the incident would represent the largest cryptocurrency theft ever recorded, although investigations are ongoing and the final amount involved could change.

Binance disclosed that its preliminary investigation indicated that the attackers gained access to its network through a compromised laptop belonging to one of its engineers.

The breach reportedly allowed the hackers to access a service container and submit unauthorised withdrawal transactions.

However, the exchange said it had found no evidence that its private keys, which provide control over cryptocurrency holdings, had been compromised.

Binance temporarily suspended deposits and withdrawals across several networks while investigating the incident.

The company maintained that customer funds remained safe and promised to publish an updated proof of reserves after completing its recovery efforts.

A Binance spokesperson said approximately $3 billion had been frozen through the cooperation of industry partners.

The exchange also confirmed that it had begun recovering affected assets while working with law enforcement agencies, cryptocurrency issuers and blockchain intelligence companies to trace and recover additional funds.

Security researchers at TRM Labs attributed the attack to a North Korean hacking group known as TraderTraitor, which has previously been linked to major cryptocurrency thefts.

The group was also blamed for the $1.4 billion theft from cryptocurrency exchange Bybit in 2025.

Blockchain security company Elliptic independently linked the Binance incident to North Korean hackers, noting that some stolen funds were transferred to a wallet associated with an earlier attack on Bitget, where approximately $351 million was stolen.

According to TRM Labs, the attackers reportedly completed the theft within about 20 minutes.

The incident has raised serious questions about Binance’s internal security controls, particularly how a compromised employee device could provide access to systems handling billions of dollars in digital assets.

Investigators are examining how the employee’s laptop was compromised and whether weaknesses in third party software contributed to the breach.
North Korea has repeatedly been accused by the United States and its allies of using cryptocurrency theft to generate funds for its sanctioned weapons programmes.

However, investigations into the Binance attack remain ongoing, and the full circumstances surrounding the breach have yet to be established.

Source: TechCrunch