Binance Suffers Record $6.3bn Hack Attributed to North Korean Hackers

Record-Breaking Crypto Theft

Binance, the world’s largest cryptocurrency exchange, has confirmed a massive security breach that resulted in the theft of approximately $6.3bn in digital assets. The incident, which began on the morning of October 29, has been identified by leading blockchain analytics firms as the largest crypto theft on record. The attack significantly surpasses the previous industry record of $1.5bn stolen from rival exchange Bybit in February 2025. The breach has sent shockwaves through the global financial sector, highlighting vulnerabilities in the infrastructure supporting the rapidly growing digital asset market.

North Korean Link Confirmed

Multiple independent investigations have pointed to North Korean state-sponsored actors as the perpetrators. TRM Labs, a prominent blockchain analytics firm, reported that the theft amounted to $6.36bn and attributed the attack to TraderTraitor, an elite hacking unit linked to the North Korean regime. Chainalysis, another major analytics provider, corroborated this assessment, also linking the heist to the same group. North Korea has a documented history of targeting cryptocurrency exchanges to circumvent international sanctions and fund state operations. The FBI previously linked similar tactics to the theft of $1.5bn from a Tokyo-based exchange last year.

Multiple Points of Entry

Binance initially reported that the breach may have involved a compromised laptop belonging to one of its DevOps engineers. This device allegedly allowed attackers to gain access to a service container, enabling unauthorized withdrawals. However, in a subsequent update, the exchange clarified that the incident was more complex. Binance stated that its investigation uncovered additional points of breach, indicating that the compromised computer was not the sole vector for the attack. The company emphasized that there is no evidence of any private key leaks from its wallets, suggesting the attackers exploited operational security flaws rather than breaking cryptographic encryption.

Asset Freezes and Compensation

In response to the breach, Binance acted swiftly to mitigate losses. The exchange froze withdrawals across its platform and worked with partners to locate and secure affected assets. As of the latest update, Binance has successfully frozen approximately $3bn of the stolen funds. The status of the remaining $3.3bn remains unclear, with the company providing no specific timeline for recovery. Yi He, co-founder of Binance, assured users that their funds are safe and committed to covering all hacking losses. The compensation will be drawn from the company’s Secure Asset Fund for Users (SAFU), an emergency reserve, as well as corporate funds.

Industry Implications

The scale of the Binance hack underscores the persistent security risks facing centralized cryptocurrency exchanges. With over 335 million registered users and $162.8bn in assets under custody as of 2025, Binance’s operational integrity is critical to market stability. The involvement of a state-sponsored actor suggests a sophisticated, well-resourced threat landscape. Regulators and industry analysts are likely to scrutinize Binance’s security protocols more closely in the coming weeks. The company has promised to release a root-cause report detailing the technical specifics of the breach, which will be closely watched by the broader financial technology community.

Key takeaways

• Binance lost approximately $6.3bn in a security breach attributed to North Korean hackers.
• TRM Labs and Chainalysis identified TraderTraitor as the responsible hacking group.
• A compromised engineer's laptop was an initial entry point, but additional breaches were found.
• Binance has frozen $3bn of assets and pledged to cover all losses via its SAFU reserve.
• The incident is the largest crypto theft on record, exceeding the previous $1.5bn Bybit hack.