North Korea-linked hackers blamed for record $6.3B Binance theft

• TechWatch PH

North Korean hackers are believed to be behind the theft of more than $6.3 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange, in what cybersecurity investigators describe as the biggest cryptocurrency heist in history.

The massive cyberattack began on October 29 and unfolded across multiple blockchain networks, with most of the stolen funds transferred in just 20 minutes.

Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group previously linked to major cryptocurrency thefts.

TRM Labs estimated the stolen assets at $6.36 billion across 10 blockchain networks, including Bitcoin, Ethereum, Tron, Solana and XRP Ledger.

The amount is more than four times the $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025, another attack attributed to North Korean hackers.

Investigators believe the attackers compromised systems used by Binance to authorize cryptocurrency transfers, allowing them to move billions of dollars from the exchange’s internet-connected wallets.

Binance initially identified a compromised laptop belonging to a DevOps engineer as a possible entry point. However, subsequent investigations uncovered additional points of compromise.

The company said it had found no evidence that wallet private keys were leaked.

Binance temporarily suspended cryptocurrency withdrawals while conducting security checks and strengthening its infrastructure.

Despite the unprecedented losses, Binance assured customers that their funds would be protected.

“We want to be clear about our commitment: Binance will absorb the financial impact of these stolen funds, not our users,” Binance said in its October 30 security update.

The exchange has set aside more than $6.34 billion in company funds to cover the losses, including approximately $5 billion in replacement cryptocurrency assets.

Binance also confirmed that around $3 billion worth of stolen cryptocurrency had been frozen through coordinated efforts involving stablecoin issuers, blockchain intelligence firms and law enforcement agencies.

The company plans to restore withdrawals in phases and publish an updated proof-of-reserves report by November 2.

The incident highlights the growing threat posed by state-sponsored cybercriminal groups targeting cryptocurrency exchanges and digital financial infrastructure.

While blockchain investigators have expressed high confidence in attributing the attack to North Korea, Binance has not independently confirmed the identity of the perpetrators.

The exchange said its investigation remains ongoing and promised to publish a detailed technical report once its findings are verified.