North Korean hackers have been identified as the culprits behind an unprecedented cryptocurrency theft, following a cyberattack on the Binance exchange. They reportedly seized approximately $6.3 billion in digital assets from the company, although security experts have noted that about half of this amount has been frozen as it transferred through various blockchain networks.
This incident marks the largest recorded cryptocurrency theft to date, although the situation has yet to be fully resolved, and the final total of stolen assets may alter.
In a post on X, Binance indicated that its preliminary inquiry revealed that the hackers gained entry into its systems through a laptop belonging to a compromised employee. This breach enabled unauthorized withdrawal transactions from Binance’s service container.
Binance has stated that there is no evidence of compromised private keys, which would provide hackers with unrestricted access to the company’s crypto reserves.
As a precautionary measure, the crypto exchange, which is the largest of its kind globally, has temporarily halted all deposit and withdrawal activities while it investigates the breach. Reports have surfaced that withdrawals have been paused across several of its blockchain networks.
While Binance reassured users that their funds are secure, it did not immediately substantiate this assertion. The company plans to release an updated proof of reserves once it has rectified the situation.
Details surrounding the method of the hack and the conditions leading to the employee’s laptop being compromised remain unclear. However, it is not uncommon for security breaches to originate from compromised software on employee devices.
Software typically comprises numerous components, including open-source tools that hackers frequently target to harvest data. In some cases, malware hidden within seemingly harmless applications can allow hackers to obtain sensitive information, enabling them to impersonate legitimate employees.
Binance may face scrutiny over how its security measures allowed a single employee’s device to access systems capable of managing billions in assets.
Representatives from Binance did not respond to requests for comments regarding the breach. Additionally, inquiries were made about whether Binance had undergone a prior security audit to identify vulnerabilities, a common practice in the industry.
Researchers from TRM Labs, specializing in blockchain forensics, connected the breach to North Korean hackers, describing it as the “largest hack in history.” This group, known in cybersecurity circles as TraderTraitor, is dedicated to stealing cryptocurrency from significant organizations and exchanges. They were previously implicated in another major theft, in which $1.4 billion was taken from the crypto exchange Bybit in 2025.
TRM Labs reported that the theft from Binance took roughly 20 minutes.
The blockchain security firm Elliptic also attributed the theft to North Korean hackers, noting that some of the stolen assets were traced to a wallet involved in a previous hack of the Bitget exchange earlier this year, which resulted in a loss of $351 million.
The U.S. government and its allies have long highlighted the risks posed by North Korea, which remains isolated from both the U.S. and the global financial system due to its ongoing nuclear weapons development. Experts suggest that the regime’s primary aim is to steal cryptocurrencies to fund its weapons programs.
