Binance hack likely tied to North Korean unit, researchers say
Researchers say TraderTraitor likely stole about $6.36 billion from Binance, while the exchange says it froze roughly $3 billion in assets.
By Sal Moretti · Money Reporter
2 min read
The reported Binance hack North Korea link is a high-confidence assessment by private cybersecurity researchers, not a final public government attribution. TRM Labs said TraderTraitor, a North Korea-linked hacking unit, likely moved about $6.36 billion from Binance wallets across 10 blockchains.
The rounded $6.3 billion figure has been described by analysts as the largest cryptocurrency theft on record. TRM Labs said most of the transfers occurred in roughly 20 minutes.
Was North Korea behind the Binance hack?
TRM Labs said it attributed the theft to TraderTraitor with high confidence. Jonathan Levin, chief executive and co-founder of blockchain research firm Chainalysis, also said the attack was likely carried out by the group, according to CBS News.
Researchers associate TraderTraitor with the wider Lazarus Group, a North Korea-linked network that the U.S. Treasury Department says has targeted organizations in government, finance and other fields. The FBI attributed a separate $1.5 billion theft from crypto exchange Bybit in 2025 to TraderTraitor, CBS News reported.
The Wall Street Journal also reported that cybersecurity researchers and investigators had pointed to blockchain activity as evidence of TraderTraitor's involvement. Neither report establishes a final official finding by a government.
What Binance says happened to customer funds
Binance said deposits were not affected. The exchange temporarily halted withdrawals and said they were expected to restart within a day or two.
The company said it would cover customer losses and, working with blockchain partners, had frozen about $3 billion in affected assets. Frozen assets are not the same as money recovered for customers.
Binance said its early investigation pointed to a compromised laptop, then identified additional possible entry points. It said it had found no evidence that wallet private keys were leaked and planned to release further technical details after its investigation is complete.
What remains under investigation
The exact method used to breach Binance has not been confirmed. Kok Tin Gan, chief executive of cybersecurity firm NyxLab, told CBS News that the incident appeared to involve a signature giving an attacker continuing, full access to a Binance hot wallet, an internet-connected crypto wallet. That was Gan's assessment, not a confirmed Binance account.
Binance said its teams were working with law enforcement to identify those responsible. Former Binance chief executive Changpeng Zhao, who founded the exchange in 2017 and remains a shareholder, said customer funds were safe and that he expected losses to be covered.
This story draws on original reporting from CBS News.