Binance Faces Massive Hack Allegedly Linked to North Korean Unit

The Binance logo is seen on a smartphone in Marple Township, Pa., on February 28, 2023. A U.S.-based blockchain intelligence firm indicates a North Korean unit may be responsible for a hack involving more than $6 billion on Binance, the largest cryptocurrency exchange globally. Binance collaborated with blockchain partners to freeze roughly $3 billion of the compromised assets and stated that asset recovery for users is underway. Deposits remain unaffected, though withdrawals were temporarily halted with plans to resume within a day or two. Binance announced it will cover all losses.

On X, the company disclosed that an initial investigation pointed to a compromised laptop, but further inquiry revealed additional breaches. TRM Labs, in a web post, attributed the attack to TraderTraitor, termed North Korea’s elite hacking unit. “We make this judgment with high confidence,” TRM expressed. The attacker allegedly moved around $6.36 billion out of Binance wallets across ten blockchains, mostly within a span of about 20 minutes. This incident, TRM said, could be the largest cryptocurrency theft recorded to date.

In a similar incident last year, Bybit, another cryptocurrency exchange, incurred a $1.5 billion loss from a hack attributed by the FBI to North Korea and TraderTraitor. TRM identified similarities between this attack and previous North Korea-related heists, including the Bybit incident. Jonathan Levin, co-founder and CEO of Chainalysis, supported TRM’s assessment, suggesting the Binance hack likely involved the DPRK group TraderTraitor. DPRK stands for the Democratic People’s Republic of Korea, North Korea’s official designation.

A Binance representative, addressing potential North Korean connections, stated that the company is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.” North Korea has reportedly been using crypto hacking to generate vital foreign currency to support its strained economy and nuclear program amidst challenging U.N. sanctions and other issues. South Korea’s spy agency reported that North Korean hackers had stolen about 1.5 trillion won ($1.1 billion) in digital assets over the past five years, with over half in 2022 alone. Their capability in stealing digital assets is deemed among the best worldwide.

Binance was established by Changpeng Zhao, also known as CZ, in 2017. In 2023, Zhao admitted guilt to a felony related to failing to prevent money laundering on the platform and resigned as CEO. U.S. President Donald Trump later pardoned him in 2025. Zhao wrote on X, “User funds are safe!” but acknowledged that the theft “does look like a hack on Binance.” As a shareholder, he anticipates all user funds will be fully covered despite not managing Binance anymore.

This breach has prompted questions about the security measures in place. Kok Tin Gan, CEO of NyxLab, indicated that “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet.” These wallets store users’ “private keys” digitally and are internet-connected. Binance communicated on X that there’s “no evidence of any wallet private key leak” and pledged to share more technical insights once their investigation concludes.