North Korean hackers are suspected of carrying out a record-breaking $6.3 billion theft from cryptocurrency exchange Binance, according to US-based blockchain analysis firm TRM Labs. In a blog post, the firm attributed the attack to TraderTraitor, a hacking group linked to North Korea, saying the attackers moved billions of dollars from Binance wallets across multiple blockchain networks within minutes.
The firm said: “An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes.”
Explaining its assessment of the perpetrators, TRM added: “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.”
If confirmed, the incident would be the biggest cryptocurrency theft recorded so far. The previous record was the $1.5 billion Bybit hack in February 2025.
Binance Suspects Compromised Employee Laptop
Binance's initial investigation has pointed towards a possible security breach involving a laptop belonging to a DevOps engineer. The exchange said the compromised device may have allowed the attacker to access a service container and initiate unauthorised withdrawals.
In its statement, Binance said, as per Hindustan Times: “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.”
The exchange said approximately $3 billion had been frozen following the incident. It also pledged to “cover all losses” through its Secure Asset Fund for Users (SAFU) and company funds.
Binance further said it was cooperating with law enforcement agencies to “confirm the identity of these criminals and bring them to justice.”
ALSO READ: 'Let Me Handle Politics': Fadnavis Takes Dig At Thackeray Cousins, Uddhav, Raj Respond With Wit
How Hackers Allegedly Drained Binance Wallets
TRM Labs outlined how the attackers allegedly executed the operation across ten blockchain networks.
It said: “On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorizations prepared in advance. In the same window, Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.”
According to the analysis, the attack indicated a possible compromise of Binance's hot wallet signing infrastructure, which is used to authorise cryptocurrency transactions.
Crypto Firms Freeze Billions As Hacker Moves Funds
Several cryptocurrency companies and blockchain networks intervened to restrict access to the stolen assets.
TRM reported: “Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion.”
However, the attacker allegedly attempted to move funds before further restrictions could be imposed. According to TRM, the hacker “raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave.”
The attacker was subsequently holding more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion, which TRM described as assets beyond the reach of issuers capable of freezing them.