$6.36B Moved From Binance Wallets In 20 Minutes, Blockchain Firms Say

Blockchain intelligence firm TRM said Thursday that a North Korean hacking unit likely drained approximately $6.36 billion from Binance wallets across ten blockchains, with most of the money moving in about 20 minutes. Chainalysis reached a similar conclusion, with co-founder and CEO Jonathan Levin writing on X that the theft was "likely done by DPRK group TraderTraitor." TRM described TraderTraitor as North Korea's elite hacking unit and said, "We make this judgment with high confidence."

The scale would make the incident the largest cryptocurrency theft on record, TRM said. The previous benchmark came in February last year, when Bybit lost $1.5 billion in a hack that the FBI later attributed to North Korea and TraderTraitor. "Several features of this attack match earlier North Korea-linked heists, including the Bybit hack," TRM said.

Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets and began returning funds to users Friday. Deposits remained active, while withdrawals were suspended and were expected to resume within a day or two. The exchange said it would cover all losses. Changpeng Zhao, who founded Binance in 2017 and stepped down as CEO in 2023, posted on X that "User funds are safe!" He added that the theft "does look like a hack on Binance" and that as a shareholder he expects full coverage of user funds.

A Binance spokesperson said the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice." The company's initial review suggested a compromised laptop, but a subsequent investigation identified additional "points of breach." Binance said on X it had found no evidence of a wallet private key leak and would release technical details when its probe concludes.

Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, said the incident raises questions about approval controls. "This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said. In December 2022, South Korea's spy agency estimated that North Korean hackers had stolen about $1.1 billion in cryptocurrency over the prior five years, with more than half of that total taken in 2022 alone.