Binance, the world’s largest cryptocurrency platform, mentioned hackers stole $6.3 billion price of funds in a Thursday night assault that doubtless quantities to the most important crypto theft in historical past.
A number of blockchain safety corporations mentioned the stolen funds had been being routed by way of addresses beforehand tied to North Korean hackers who’ve repeatedly stolen billions price of cryptocurrency from platforms over the past 5 years.
In a put up mortem, Binance traced the breach again to a compromised laptop computer owned by an engineer on the firm. The compromised laptop computer allowed the attacker to acquire entry to methods that enabled unauthorized withdrawal transactions, Binance mentioned.
Whereas $6.3 billion was stolen, about $3 billion has been frozen by different crypto platforms that the hackers tried to use to launder the funds.
Tether, Circle, Ripple, World Liberty Monetary and Arbitrum all joined forces to assist Binance and freeze the funds however the attackers quickly sold stablecoins and took out loans towards different stolen funds, leaving them with greater than $2.4 billion in Ethereum and Bitcoin.
Binance officers pledged to cowl all losses utilizing firm funds and reiterated that consumer funds are protected.
The corporate suspended deposits and withdrawals whereas additionally contacting regulation enforcement businesses and blockchain safety corporations to hint and get well the stolen funds.
“Consumer funds are protected. Binance will cowl all hacking losses. Deposits and withdrawals are briefly suspended whereas our group conducts safety checks, freezes funds, and works with regulation enforcement,” Binance co-founder Yi He said, including that the withdrawal suspension would final 48 hours.
Blockchain safety corporations TRM Labs and Chainalysis each pointed the finger at North Korea’s TraderTraitor hacking group.
TraderTraitor has been repeatedly spotlighted by the FBI and experts as the most typical offender behind a number of high-profile cryptocurrency thefts. In accordance to the FBI, the group was chargeable for stealing $1.4 billion from Dubai-based crypto platform Bybit final yr and nearly $300 million from one other crypto firm known as KelpDAO in April 2026.
Final month, crypto platform Bitget mentioned North Korean hackers stole more than $387 million in a cyberattack. Chainalysis mentioned on Thursday night that funds from the Binance assault had been seen commingling in wallets with cryptocurrency stolen from Bitget.
Chainalysis mentioned it has a “excessive diploma of confidence that DPRK” was chargeable for the Binance assault. In its personal weblog TRM Labs additionally attributed the theft to TraderTraitor “primarily based on sturdy on and off-chain intelligence.”
“A number of options of this assault match earlier North Korea-linked heists, together with the Bybit hack and the KelpDAO hack in April 2026: small Twister Money withdrawals funding an operator pockets, staging that started effectively earlier than the theft, and signatures obtained prematurely then executed in a single burst,” TRM Labs mentioned, noting that proof confirmed preparations for the assault started 36 hours earlier than.
North Korea has waged an unprecedented assault on the crypto trade for years, stealing huge sums every year that U.S. officers say is used to fund Pyongyang’s authorities and army weapons program.
The nation’s authorities stole more than $2 billion in similar attacks last year and introduced in $3 billion from assaults between 2017 and 2023, according to United Nations investigators.
The FBI previously said TraderTraitor was behind a number of headline-grabbing incidents in 2023 and 2024 in addition to the $100 million hack of Concord’s Horizon bridge and the $600 million hack of Sky Mavis’ Ronin Bridge.
On Thursday, Microsoft published a prolonged investigation into North Korea’s use of synthetic intelligence in cyberattacks. The corporate mentioned North Korean hackers are utilizing AI to create entrance corporations, generate tailor-made phishing lures and extra. Some North Korean teams had been additionally seen leveraging controversial AI penetration testing tool ARTEX to conduct operations.
Microsoft mentioned these operations “generally goal cryptocurrency and monetary organizations, data know-how corporations and software program provide chains, authorities entities, and education-related organizations.”
