Binance loss tied to North Korean hackers in $6.3 billion theft

Two major blockchain analytics companies report that a North Korean state-backed hacking group likely stole $6.3 billion from Binance, the world's largest cryptocurrency exchange. The firms, TRM Labs and Chainalysis, identified the Lazarus Group, also known as TraderTraitor, as the prime suspect with high confidence.

The incident marks the largest known theft from a crypto exchange to date. North Korea, a country with strict internet controls, has been accused by experts of using cybercrime to generate revenue for the government. Pyongyang has traditionally denied these accusations, but the pattern of thefts has continued over the past decade.

The FBI previously attributed a $1.5 billion theft from the Bybit exchange in 2025 to the same North Korean unit. The agency noted that the hackers quickly converted the stolen assets into Bitcoin and other digital currencies to disguise their origin. North Korea has also been linked to a $620 million cryptocurrency theft in 2022.

In the current case, the attackers reportedly used a specific authorization to alter a Binance hot wallet. This change allowed funds to move automatically to the attacker's control. TRM Labs stated that the attacker likely gained access to the wallet's signing system to execute the scheme.

Binance initially suggested that an engineer's compromised laptop was the cause of the unauthorized withdrawals. The company later expanded its explanation, indicating the attack involved a wider breach of systems. Richard Teng, Binance's co-CEO, said, "Our subsequent investigation has uncovered additional points of breach."

A Binance spokesperson stated on Friday that the company has secured 80 percent of the stolen assets. The remaining funds are currently unaccounted for. Binance has not directly responded to queries regarding the specific links to the North Korean group.

Reports indicate that North Korea recruits promising university students for its intelligence agency's hacker groups. Some operations are conducted from just across the border in China. Chainalysis noted that the attacker used laundering patterns that analysts had not previously observed in similar cases.