Photo: Satheesh Sankaran, CC BY 2.0, via Wikimedia Commons. File photo illustrating cryptocurrency, not a photo of the Binance hack.
Hackers stole more than $6 billion from Binance, the world's biggest cryptocurrency exchange, in what appears to be the largest cryptocurrency heist on record — and blockchain investigators say the trail points to North Korea's elite hacking unit.
Binance said on Friday that it had reserved more than $6.34 billion of company funds to cover the stolen assets and was beginning to recover assets for users. Working with blockchain partners, the company has frozen roughly $3 billion in affected assets, but some of what was not recovered is already being moved and converted, analysts say.
The company has promised to cover all losses. Deposits were unaffected, while withdrawals have been suspended and are expected to resume in the next day or two, Binance said.
Blamed on North Korea's TraderTraitor
U.S.-based blockchain intelligence firm TRM Labs said in a post on its website late Thursday that the attack was carried out by TraderTraitor, which it described as North Korea's elite hacking unit. "We make this judgment with high confidence," the firm said.
"An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," TRM said. "Several features of this attack match earlier North Korea-linked heists."
Blockchain analysis company Chainalysis also believed the Binance hack was likely carried out by TraderTraitor, its co-founder and chief executive Jonathan Levin wrote on X.
Binance itself has not confirmed who was behind the attack. A company spokesperson said only that it is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice." In an exchange with reporters at the White House on Friday, President Donald Trump said U.S. officials were investigating the hack. Asked whether North Korea was involved, he said: "We're looking at that."
How the heist happened
Binance said on X that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional "points of breach."
Co-chief executive Richard Teng confirmed in a video posted on X on Friday that Binance's own hot wallet — a wallet connected to the internet that holds users' private keys, or unique authorisations — was affected. "User assets are held under Binance's established security architecture," he said. "The vast majority sits in cold wallets" — which are offline — "and are only moved into a hot wallet when a user makes withdrawal."
Teng said Binance's tech and security teams were "still deep" in investigating the hack, which he said was not carried out by one person and involved complex tactics, including a "self-destruct mechanism" that is making the incident more difficult to investigate.
The hack has raised questions about why stronger approval controls were not in place, said Kok Tin Gan, co-founder and chief executive of cybersecurity firm NyxLab. "This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said.
Once stolen, cryptocurrency can be hard to recover. "Like in money laundering, you bring in the stolen goods and launder those through a mixer or tumbler," said Garrick Hileman, an independent cryptocurrency analyst. "You mix it in with other cryptos, and it's harder to track."
A record that dwarfs the last one
TRM and several other crypto firms and experts have said the hack represents the largest cryptocurrency theft on record. The previous record was set in February of last year, when the exchange Bybit suffered a $1.5 billion hit. The FBI said North Korea and TraderTraitor were responsible for that attack.
Binance's founder, Changpeng Zhao, wrote on X that while the Binance hack might be the largest in terms of its dollar value, previous attacks on other companies like the exchange Mt. Gox had a more substantial impact in terms of the amount of bitcoin affected.
Experts say North Korea has turned to crypto hacking as a source of badly needed foreign currency to support its troubled economy and fund its nuclear programme, in the wake of tough U.N. sanctions. Chainalysis put North Korea's crypto thefts at at least $6.75 billion in a December 2025 report, according to Reuters, and researchers say the true total, including other recent heists, is higher still.
A warning for the whole industry
The scale of the attack has shaken confidence well beyond Binance. Cryptocurrency-related stocks fell on Friday after the theft was reported, with Coinbase, Strategy and Robinhood dropping between 7.2 and 10.6 percent.
"A cyber attack of this level is a matter of when, not if, particularly alongside the rise of AI," said Andy Ward, a senior vice president at Absolute Security. "Cyber threats are becoming more sophisticated and widespread as ever, and it is likely only a matter of time before an even larger hack, with even greater financial fallout, makes headlines."
For Binance's millions of users, the immediate question is simpler: when withdrawals fully resume, and how much of the stolen $6.3 billion investigators can claw back before it disappears into the crypto laundering machine.
Sources: The Associated Press; Reuters.