Washington: North Korean hackers are suspected of carrying out a cryptocurrency theft worth an estimated $6.36 billion from Binance, the world’s largest cryptocurrency exchange. If confirmed, the incident would be the biggest cryptocurrency theft on record, according to US blockchain intelligence firm TRM Labs.
The firm said the attack, which took place on Thursday, was most likely carried out by TraderTraitor, a North Korean hacking group previously linked to major cryptocurrency thefts.
According to TRM Labs, the hackers stole digital assets across 10 blockchain networks, with most of the funds moved within just 20 minutes.
The firm said it had “high confidence” that TraderTraitor was behind the attack. Its assessment was based on an analysis of cryptocurrency transactions and similarities with earlier hacking operations attributed to North Korean groups, Yonhap News Agency reported.
Hackers Prepared for Attack 36 Hours in Advance
TRM Labs said the hackers had started preparing for the operation at least 36 hours before carrying it out.
The firm believes they gained access to systems used to authorise cryptocurrency transfers. This may have allowed them to move digital assets without permission.
Following the theft, around $2.7 billion worth of stolen assets were frozen through cooperation between cryptocurrency companies and blockchain operators.
However, the hackers were still believed to control approximately $2.4 billion in Bitcoin and Ethereum, two of the world’s most widely traded cryptocurrencies.
TRM Labs warned that the attackers could attempt to conceal the origins of the stolen funds by transferring them across different blockchain networks and cryptocurrency trading platforms.
Binance Assures Users of Full Compensation
Binance co-CEO Richard Teng said the company was working continuously to address the situation and assured users that their funds were safe.
In a post on X, Teng said Binance was committed to covering all losses caused by the hack through its own company funds.
“We are committed to covering all hacked losses through our company funds. Your assets are safe,” he wrote.
Teng also said Binance had reserved more than $6.34 billion in company funds to cover the stolen assets. Of this amount, $5 billion was already held in the exact token assets affected by the incident.
Biggest Crypto Theft, Surpassing Bybit Hack
The estimated $6.36 billion theft would be significantly larger than the $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025.
The US Federal Bureau of Investigation had attributed that earlier attack to TraderTraitor, the same North Korean hacking group now suspected of being behind the Binance incident.
US officials have previously said that North Korea uses networks of its nationals living abroad and foreign-based facilitators to launder stolen cryptocurrency into traditional currencies.
These networks reportedly operate in countries including China, Russia, Cambodia and Vietnam. The money is believed to be used for procurement activities and to support North Korea’s weapons of mass destruction programmes.
The latest incident has once again raised concerns about the growing threat posed by state-linked cybercrime groups to the global cryptocurrency industry.