Binance Hack: $6.3 Billion Stolen, Withdrawals Paused

Binance has suspended withdrawals for its users following a theft of approximately $6.36 billion, the largest cryptocurrency hack recorded to date. The platform stated on Friday that deposits remain open, but withdrawals are paused for one or two days while the company investigates the breach. Binance confirmed it will cover all losses, assuring users that their funds are secure.

Blockchain intelligence firm TRM attributes the attack to TraderTraitor, an elite hacking unit from North Korea. The company said it makes this assessment with a high degree of confidence. An attacker moved funds from Binance wallets across ten different blockchains, completing the majority of the transfer in about twenty minutes.

Chainalysis, another major blockchain analysis firm, reached a similar conclusion. Its co-founder and CEO, Jonathan Levin, wrote on X that the hack was likely carried out by the TraderTraitor group from the Democratic People's Republic of Korea. This follows a $1.5 billion hack on the exchange Bybit in February of last year, which the FBI also linked to North Korea and TraderTraitor.

Binance officials said an initial investigation pointed to a compromised personal computer as the entry point. A deeper review later identified additional vulnerabilities. A company spokesperson said Binance is working closely with security partners to confirm the identity of the culprits and bring them to justice. The firm noted it found no evidence of leaked private keys from wallets.

Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, questioned the access controls in place at the time. He stated that a single signature appeared to grant an attacker a full-access token to a Binance hot wallet that did not expire. Hot wallets are internet-connected digital storage systems that hold private keys and user authorizations.

Changpeng Zhao, who founded Binance in 2017 and left the CEO role in 2023 after pleading guilty to a felony related to money laundering controls, posted on X that user funds are safe. Zhao, who was pardoned by President Donald Trump in 2025, said the incident looks like a hack on Binance. As a shareholder, he expressed hope that all user funds are fully covered. South Korean intelligence agencies have previously estimated that North Korean hackers stole about $1.1 billion in crypto assets over five years ending in 2022, noting the country possesses some of the best capabilities for stealing digital assets in the world.

The theft underscores the financial pressure on North Korea, which relies on cybercrime to generate foreign currency for its economy and nuclear program amid strict United Nations sanctions.