North Korean hackers blamed for stealing record $6.3B in Binance breach

If you store cryptocurrency on Binance, your funds were exposed to a record-breaking breach that lasted approximately 20 minutes.

Hackers linked to the North Korean regime are believed to have stolen a record $6.3 billion in cryptocurrency from Binance, the world's largest crypto exchange. Security researchers from TRM Labs and Elliptic attributed the breach to a North Korean cybercell known as "TraderTraitor," which has previously been linked to a $1.4 billion theft from Bybit in 2025 and a $351 million hack of Bitget earlier this year. Binance stated that the attackers gained access by compromising an engineer's laptop, enabling them to submit unauthorized withdrawal transactions. While approximately half of the stolen funds were subsequently frozen as they moved across blockchains, the exchange has suspended all deposits and withdrawals during its investigation. Binance has assured users that their funds are safe and plans to publish an updated proof of reserves once remediation is complete.

This incident highlights the persistent threat of state-sponsored hacking groups targeting the cryptocurrency sector for financial gain, particularly to fund illicit activities like weapons development. The scale of this breach, the largest ever recorded in crypto, underscores the evolving sophistication and audacity of these actors. The method of attack, exploiting a single engineer's compromised laptop, also raises critical questions about internal security protocols at major exchanges and the potential vulnerabilities inherent in supply chain attacks on software components.

Binance's assertion that "user funds are safe" will face intense scrutiny, especially as the exchange navigates the complexities of proving reserves post-breach. The long-term implications for user trust and regulatory oversight within the crypto industry could be significant, potentially leading to stricter security mandates for exchanges. The ongoing recovery efforts and transparency regarding the full extent of the damage will be closely watched by users, regulators, and competitors alike.