North Korean Hackers Linked to Record $6.3bn Binance Crypto Theft

Binance has pledged to cover customer losses following a $6.3bn (£4.7bn) security breach, with blockchain analysts linking the attack to North Korea’s TraderTraitor hacking group.

The world’s largest cryptocurrency exchange is working to trace and recover assets following what analysts have described as the biggest cryptocurrency theft on record.

Approximately $3bn in affected assets has been located and frozen through efforts involving Binance and its industry partners. The exchange’s co-founder, Yi He, said the company would cover “all hacking losses”.

Blockchain intelligence firms TRM Labs and Chainalysis attributed the attack to TraderTraitor, a North Korean state-backed hacking unit. TRM said it had “high confidence” in its assessment.

The incident surpasses the previous record cryptocurrency theft, when approximately $1.5bn was stolen from Dubai-based exchange Bybit in 2025. The FBI attributed that attack to North Korea.

Binance promises to cover losses

Binance said its teams were “working around the clock” to investigate the breach, secure its infrastructure and recover affected funds.

An initial investigation suggested that an attacker had compromised an engineer’s laptop, gaining access to an internal system and submitting unauthorised withdrawal transactions.

Richard Teng, a co-chief executive of Binance, sought to reassure customers, saying: “Bottom line – your money is safe, and we’re covering every loss.”

Announcing its initial precautionary measures, Binance said: “As a precaution, all deposits and withdrawals are temporarily suspended while our security teams conduct checks, secure wallet infrastructure and trace affected assets, with the close support of our law enforcement and industry partners.”

The platform has 335 million registered users worldwide. Its 2025 annual report recorded approximately $162.8bn in assets under custody.

Binance operates a secure asset fund for users, a reserve held in bitcoin intended to help protect customers in the event of security breaches.

Founder responds to attack

Binance founder Changpeng Zhao also addressed the incident on X, posting: “User funds are safe!”

However, he acknowledged that the incident “does look like a hack on Binance”.

Zhao, who stepped down as chief executive in 2023, said that although he no longer managed the exchange, “as a shareholder, I expect all user funds will be fully covered”.

He founded Binance in 2017 and pleaded guilty in the US in 2023 to a felony relating to failures to prevent money laundering on the platform. Donald Trump pardoned him in 2025.

In a separate update, Binance said it was continuing “to trace, freeze and recover additional funds”, adding: “We will weather this storm. Thank you for the support.”

Bitcoin falls as security concerns grow

The breach prompted an immediate market reaction during early Asian trading on Friday. Bitcoin fell by more than 3%, reaching a six-week low of $76,368.

Aravind Srinivasan, head of crypto market maker GSR’s systematic OTC business, said: “It’s the biggest hack in history.”

The attack comes during a challenging period for digital assets, with higher US interest rates and weaker demand from exchange-traded fund buyers already weighing on sentiment.

Analysts warned that the consequences could extend beyond the stolen funds, raising further questions about the security of assets held on centralised trading platforms.

“It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges,” said Tim Sun, a senior researcher at Hong Kong-based HashKey Group.

Stablecoin issuers freeze linked assets

Stablecoin issuers have joined efforts to restrict the movement of funds associated with the breach.

Tether said it had frozen nearly $1.57bn in linked assets, while Circle froze more than $800m.

The scale of the incident has also highlighted the growing challenges facing cryptocurrency businesses as attackers develop more sophisticated methods.

Bernardo Brites, chief executive of payments and stablecoin infrastructure company Trace Finance, said: “It’s becoming very hard to counter hacks as AI can find vulnerabilities faster than you can fix them.”