Key Takeaways
- • Binance, the world's largest cryptocurrency exchange, said a hack impacted more than $6 billion US, with the company initially freezing roughly $3 billion and later updating that figure to $5 billion US on Friday.
- • U.S.-based blockchain intelligence firm TRM attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit, saying it had "high confidence" in the judgment.
- • TRM said approximately $6.36 billion US was moved out of Binance wallets across 10 blockchains, most of it in about 20 minutes, which would make it the largest cryptocurrency theft on record.
- • Binance said deposits were unaffected, withdrawals were suspended and expected to resume within a day or two, and the company will cover all losses.
- • Chainalysis also said the hack was likely carried out by TraderTraitor, while Binance said it had found no evidence of a wallet private key leak and would release more technical details once its probe is complete.
Summary
Binance, the world's largest cryptocurrency exchange, is dealing with a hack that it says impacted more than $6 billion US, a loss that could be the largest cryptocurrency theft on record. In an early Friday statement, Binance called the event a "complex attack" and said it worked with blockchain partners to freeze roughly $3 billion US in affected assets. The company updated that figure to $5 billion US on Friday afternoon, and said it continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.
Binance said deposits were unaffected while withdrawals have been suspended, with resumption expected within the next day or two. The company said it will cover all losses. Initially, an investigation suggested the incident may have involved a compromised laptop, but a subsequent probe uncovered additional "points of breach," according to the company's post on X.
TRM, a U.S.-based blockchain intelligence firm, attributed the attack on Thursday to TraderTraitor, which it described as North Korea's elite hacking unit, and said it made the judgment "with high confidence." TRM said an attacker moved approximately $6.36 billion US out of Binance wallets on 10 blockchains, most of it in about 20 minutes. Chainalysis co-founder and CEO Jonathan Levin also wrote on X that the hack was "likely done by DPRK group TraderTraitor." TRM noted that several features of the attack match earlier North Korea-linked heists, including the 2025 Bybit hack, which the FBI attributed to North Korea and TraderTraitor. Asked about possible North Korean ties, a Binance spokesperson said the company is working with law enforcement to confirm the identity of the criminals.
Experts cited by CBC say North Korea has turned to crypto-hacking and other illicit cyber activities as a source of foreign currency to support its economy and nuclear program under UN sanctions. Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, said the event raises questions about why stronger approval controls were not in place, suggesting that "one signature" may have given the attacker a never-expiring, full-access token to a Binance hot wallet. Binance said it had "found no evidence of any wallet private key leak" and would release more technical details when its probe is complete.
Founder Changpeng Zhao, who stepped down as Binance CEO after pleading guilty in 2023 to a felony linked to failing to prevent money laundering on the platform, posted on X that "User funds are safe!" while acknowledging the theft "does look like a hack on Binance." As a shareholder, he said he expects all user funds will be fully covered.
Binance said deposits were unaffected while withdrawals have been suspended, with resumption expected within the next day or two. The company said it will cover all losses. Initially, an investigation suggested the incident may have involved a compromised laptop, but a subsequent probe uncovered additional "points of breach," according to the company's post on X.
TRM, a U.S.-based blockchain intelligence firm, attributed the attack on Thursday to TraderTraitor, which it described as North Korea's elite hacking unit, and said it made the judgment "with high confidence." TRM said an attacker moved approximately $6.36 billion US out of Binance wallets on 10 blockchains, most of it in about 20 minutes. Chainalysis co-founder and CEO Jonathan Levin also wrote on X that the hack was "likely done by DPRK group TraderTraitor." TRM noted that several features of the attack match earlier North Korea-linked heists, including the 2025 Bybit hack, which the FBI attributed to North Korea and TraderTraitor. Asked about possible North Korean ties, a Binance spokesperson said the company is working with law enforcement to confirm the identity of the criminals.
Experts cited by CBC say North Korea has turned to crypto-hacking and other illicit cyber activities as a source of foreign currency to support its economy and nuclear program under UN sanctions. Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, said the event raises questions about why stronger approval controls were not in place, suggesting that "one signature" may have given the attacker a never-expiring, full-access token to a Binance hot wallet. Binance said it had "found no evidence of any wallet private key leak" and would release more technical details when its probe is complete.
Founder Changpeng Zhao, who stepped down as Binance CEO after pleading guilty in 2023 to a felony linked to failing to prevent money laundering on the platform, posted on X that "User funds are safe!" while acknowledging the theft "does look like a hack on Binance." As a shareholder, he said he expects all user funds will be fully covered.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.