Two leading blockchain intelligence firms have attributed the record-breaking $6.3 billion hack of cryptocurrency exchange Binance to a North Korean state-sponsored cybercrime group, marking the largest digital asset theft in history.
TRM Labs and Chainalysis both identified the notorious hacking unit known as TraderTraitor as the likely culprit, citing patterns consistent with previous attacks on the crypto industry. The group, which operates under the umbrella of North Korean intelligence, has a long track record of targeting exchanges and blockchain platforms to generate revenue for the regime.
According to TRM Labs, the attacker drained approximately $6.36 billion from Binance wallets across multiple blockchain networks, including XRP Ledger, Ethereum, Bitcoin, Tron, and Solana. The bulk of the exfiltration occurred in a lightning-fast 20-minute window on Thursday afternoon, prompting Binance to immediately suspend all deposits and withdrawals.
While the broader crypto industry managed to freeze around $3 billion of the stolen assets—particularly stablecoins like USDT and USDC—the attacker still retains control of an estimated $2.4 billion that lies beyond the reach of any issuer or authority, TRM noted.
Chainalysis described the operation as a race against time, with the hackers swiftly converting freezable stablecoins into more liquid, non-freezable assets like Bitcoin and Ethereum. "It was only a matter of time before the issuers of those stablecoins would freeze those funds," the firm said in its analysis.
The modus operandi mirrors the $1.5 billion Bybit hack attributed to North Korea last year, according to TRM. That incident, too, involved rapid cross-chain swaps and the use of mixers to obscure fund movements.
Binance has pledged to make all affected users whole, stating Friday that it has set aside more than $6.34 billion in company reserves to cover the losses. Co-CEO Richard Teng addressed the community in a video posted to X, thanking partners and law enforcement for their swift response. "Difficult times like this are a great reminder of how strong our industry is when we work together," he said, adding that Binance is "working nonstop to resolve this, to make the users whole and live up to their trust."
The hack has reignited concerns about the security of centralized exchanges and the growing sophistication of state-sponsored cyber threats. It also underscores the challenges regulators face in policing a borderless financial system. The incident comes as U.S. lawmakers continue to debate new digital asset legislation, with some pointing to this attack as evidence of the need for stricter oversight.
For now, the industry is left to grapple with the fallout of the largest heist in its history, while global law enforcement agencies coordinate efforts to track the stolen funds. The incident also draws attention to the broader geopolitical context, as North Korea's cyber operations have long been a tool for evading international sanctions. The widespread asset freeze that followed the breach was a rare show of industry solidarity, but the fact that billions remain unrecovered highlights the limits of such measures.
As the investigation continues, the focus will likely shift to how exchanges can better harden their systems against such sophisticated adversaries, and whether international cooperation can keep pace with the evolving tactics of state-backed hackers.
