North Korea: TraderTraitor linked to $6.36 billion Binance hack

The world's largest cryptocurrency exchange, Binance, announced on Friday that withdrawals have been suspended following a major security incident that affected more than $6 billion in assets.

Binance stated that deposits remained unaffected during the disruption and that withdrawals are expected to resume within one to two days. The company said it would cover all losses resulting from the breach.

U.S.-based blockchain intelligence firm TRM published an assessment on Thursday attributing the attack to TraderTraitor, which it described as the elite hacking unit of North Korea. TRM stated that an attacker moved approximately $6.36 billion from Binance wallets across ten blockchains, with the majority of the transfer occurring within twenty minutes. This amount makes the incident the largest recorded theft in the history of cryptocurrency.

Jonathan Levin, cofounder and chief executive of Chainalysis, also identified the culprit in a post on X. He said the hack was likely carried out by TraderTraitor, a group from the Democratic People's Republic of Korea. TRM noted that several characteristics of the attack matched previous thefts linked to North Korea, including the $1.5 billion breach of Bybit in February 2025, for which the FBI blamed the same unit.

Binance said an initial investigation suggested a compromised personal computer was involved, but a subsequent review identified additional vulnerabilities. A spokesperson for the exchange said the company is working with law enforcement partners to confirm the identity of the perpetrators and bring them to justice.

Kok Tin Gan, cofounder and chief executive of cybersecurity firm NyxLab, questioned the strength of access controls at the exchange. He stated that a single signature apparently granted the attacker a full-access token without an expiration date to a hot wallet, which stores digital private keys and remains connected to the internet.

Binance said it had not found evidence of leaked private wallet keys and would release more technical details upon completing its investigation. Changpeng Zhao, the founder of Binance, said on X that user funds are safe and that the incident appears to be a hack of the company. Zhao, who pleaded guilty to a federal crime in 2023 and was pardoned by President Donald Trump in 2025, said he hopes all user funds are fully covered as a shareholder.

South Korea's intelligence agency reported in December 2022 that North Korean hackers had stolen an estimated 1.5 trillion won, or $1.1 billion, in cryptocurrency over the previous five years. Experts said the DPRK relies on such cyber activities to generate foreign currency needed to support its economy and nuclear program under strict United Nations sanctions.