Hackers stole an unprecedented $6.3 billion in a breach of Binance, the world’s largest cryptocurrency exchange, last week in what is considered the biggest theft in the industry’s history. Cybersecurity experts and investigators have largely attributed the attack to North Korea, pointing to the state-backed hacking group known as TraderTraitor, which is linked to Kim Jong Un’s regime.
The breach occurred swiftly, with most of the theft taking place in about 20 minutes. Binance said its initial investigation identified the compromise of an engineer’s laptop as the likely entry point, with additional breaches suspected. The attackers used sophisticated techniques, including a self-destruct mechanism to erase evidence, complicating efforts to trace the incident.
Blockchain analytics companies, including TRM Labs and Chainalysis, have been instrumental in tracking the stolen funds as they moved through thousands of cryptocurrency wallets. These analysts noted that the hackers quickly dispersed assets across many addresses to evade detection. While Binance and partners were able to freeze approximately $3 billion of the theft, an estimated $2.4 billion remains out of reach, having been converted into cryptocurrencies more difficult to control or seize.
The group TraderTraitor, believed to operate under North Korea’s Reconnaissance General Bureau, has been linked to numerous prior large-scale cryptocurrency heists, including a $1.5 billion theft from the Bybit exchange in 2025 and other incidents targeting exchanges in Japan and India. Experts describe TraderTraitor as a highly efficient operation that launders stolen funds at remarkable speed, sustaining the North Korean regime’s illicit revenue streams.
Industry insiders and cybersecurity experts stress that the scale of this theft underscores the ongoing security challenges facing cryptocurrency platforms. The decentralized nature of blockchain transactions—while promoting transparency—also enables rapid movement of stolen funds across borders and complicates regulatory oversight.
Binance’s co-chief executive, Yi He, pledged that the company would cover any losses using its own resources and a dedicated $1 billion reserve set aside for such emergencies. The exchange has temporarily suspended withdrawals while conducting security reviews and is working with global law enforcement agencies, including the U.S. Secret Service, which confirmed it is actively involved in tracing and recovering the stolen assets.
Former officials and financial experts have called for stronger regulatory frameworks and “guard rails” around cryptocurrency markets to prevent similar attacks in the future. While Binance itself is not authorized or operated in the UK, concerns remain about the growing intersection of crypto with mainstream financial systems.
North Korea’s cryptocurrency thefts have become a significant source of foreign currency for the highly sanctioned country, potentially funding prohibited programs such as its nuclear weapons development. Analysts warn that the staggering scale and sophistication of these cyber operations pose a growing global security threat.
Despite efforts to track and freeze stolen assets, recovery rates for prior hacks linked to North Korean groups have been low, often just a small fraction of the stolen sums. Investigators acknowledge the “tiring” challenge posed by these persistent, well-funded cybercriminal networks, highlighting the need for coordinated international response as the cryptocurrency ecosystem evolves.