Binance: Hackers Steal $6.3B in Largest Known Crypto Heist

Binance, the largest cryptocurrency exchange in the world, announced on Friday that hackers stole more than $6 billion from its systems. The company stated that the theft appears to be the largest cryptocurrency heist recorded to date. Binance reported that it had reserved $6.34 billion in company funds to cover the loss and was beginning the process of recovering assets for its users.

Blockchain intelligence firm TRM attributed the attack to a North Korean hacking unit known as TraderTraitor. The company stated that it made this judgment with high confidence. TRM noted that the attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, with the majority of the transfer occurring within about 20 minutes. Chainalysis, another blockchain analysis company, also linked the hack to TraderTraitor based on features that matched previous North Korea-linked heists.

Binance co-CEO Richard Teng said the company is working nonstop to resolve the incident. He confirmed in a video posted to X that the attack affected one of Binance's hot wallets, which are connected to the internet and hold user private keys. Teng explained that user assets are generally held in cold wallets, which are offline, and are only moved to hot wallets when a user initiates a withdrawal. The company has suspended withdrawals, which are expected to resume within the next day or two, while deposits remain unaffected.

President Donald Trump told reporters at the White House on Friday that U.S. officials were investigating the hack. When asked specifically about North Korean involvement, Trump said, "We're looking at that." A Binance spokesperson told the company is working closely with law enforcement partners to confirm the identity of the criminals. The exchange said an initial investigation suggested a compromised laptop was involved, but a subsequent review uncovered additional points of breach.

Security experts identified a potential weakness in the exchange's approval controls. Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, suggested the attacker may have used a single signature that provided a never-expiring, full-access token to a Binance hot wallet. Teng said the attackers used complex tactics, including a self-destruct mechanism, which is making the investigation more difficult. He stated that the hack was not carried out by one person.

Garrick Hileman, an independent cryptocurrency analyst, noted that while about half of the stolen assets were frozen, hackers are already transferring and converting some of the remainder. He explained that the stolen crypto is likely being passed through mixers or tumblers to obscure its origin, a process similar to money laundering. Hileman said it is unclear how long it will take for the hackers to convert the digital assets into usable currency.

The scale of this theft exceeds the $1.5 billion hit suffered by exchange Bybit in February 2025, which the FBI also linked to TraderTraitor. Binance founder Changpeng Zhao noted on X that while this hack is the largest by dollar value, previous attacks on companies like Mt. Gox affected a larger amount of bitcoin. South Korea's spy agency reported in December 2022 that North Korean hackers had stolen an estimated $1.1 billion in cryptocurrency over the previous five years, with more than half of that total stolen in 2022 alone.