North Korean hackers blamed for stealing record $6.3B in Binance breach

Hackers moving for the North Korean authorities person been blamed for a grounds cryptocurrency heist following a cyberattack astatine crypto speech Binance. The hackers stole astatine slightest $6.3 cardinal successful crypto from the company’s wallets, though astir fractional of that magnitude was frozen arsenic the stolen crypto traveled crossed assorted blockchains, according to information researchers.

The breach is by acold the largest known theft of crypto successful history, though the incidental has not been confirmed yet to beryllium resolved, and the magnitude of crypto stolen whitethorn change.

In a station connected X, Binance said its archetypal probe showed that the hackers broke into the company’s web aft targeting a “compromised” Binance engineer’s laptop, which “allowed an attacker to summation entree to a work instrumentality and taxable unauthorized withdrawal transactions.”

Binance said it has seen nary grounds of a leak of its backstage keys, which would assistance the hacker near-unfettered power implicit the company’s stores of crypto.

The crypto speech — the world’s largest — said it has present suspended each deposits and withdrawals portion its probe into the breach continues. TechCrunch reported connected Thursday that the speech had paused withdrawals crossed immoderate of its blockchains.

Binance said “user funds are safe,” but did not instantly supply impervious of this claim. The institution said it volition “publish an updated impervious of reserves erstwhile the remediation is complete.”

It’s unclear however the hack went down oregon nether what circumstances the employee’s laptop was compromised, but it’s not uncommon for information incidents to stem from the usage of compromised bundle connected worker devices.

Software is mostly built from galore components, including open-source projects, which hackers regularly target, compromise and modify successful bid to bargain information from devices that the affected bundle is installed on. Other times, malware bundled with regular-looking apps and games tin let hackers to bargain usernames, passwords and league tokens from infected computers, which whitethorn fto them log successful arsenic if they were a morganatic employee.

Binance volition look questions astir wherefore the company’s information allowed a azygous employee’s laptop to entree systems susceptible of controlling billions of dollars successful funds.

Spokespeople for Binance did not respond to a petition for remark astir the hack. TechCrunch has besides asked the institution who, if anyone, performed a information audit of Binance’s web and systems anterior to the hack. Companies regularly inquire third-party companies to stress-test their information to place weaknesses that could beryllium exploited by attackers, but it’s unclear if Binance sought specified a review.

Security researchers astatine TRM Labs, a blockchain quality and forensic company, attributed the breach to North Korean hackers, and called it the “largest hack successful history.” 

Researchers picture the web of hackers, known successful the cybersecurity manufacture arsenic TraderTraitor, arsenic a North Korean compartment focused astir exclusively connected stealing crypto from ample companies and exchanges. This radical was besides blamed for the now-second-largest heist connected record, a $1.4 cardinal theft from crypto speech Bybit successful 2025.

According to TRM, the theft of Binance’s billions successful crypto took astir 20 minutes.

Blockchain information steadfast Elliptic also attributed the Binance theft to North Korean hackers. Elliptic said immoderate of the stolen funds ended up successful the aforesaid wallet that was utilized successful a erstwhile cyberattack connected crypto speech Bitget earlier this year, successful which hackers stole $351 million.

The U.S. authorities and its allies have agelong warned astir the menace from North Korea, which remains chopped disconnected from the U.S. and the planetary fiscal strategy for its ongoing improvement of its atomic weapons program. Researchers accidental the breakaway country’s sole motivations are to bargain arsenic overmuch crypto arsenic imaginable successful bid to proceed processing its sanctioned weapons of wide destruction.