North Korean hackers allegedly steal $6 billion from Binance in World’s Largest Heist

Binance, the world’s largest cryptocurrency exchange, suspended withdrawals after hackers broke into its digital wallets and stole $6 billion in what appears to be the biggest crypto heist ever.

Binance said late Thursday night that its initial investigation indicated the hack went through an engineer’s laptop, “which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”

Blockchain evidence suggests the hack originated in North Korea, according to multiple crypto-tracing firms.

A team of cryptocurrency firms managed to freeze about $3 billion of the stolen loot amid a frenetic battle with the hackers to find and control the digital money.

Binance co-CEO Richard Teng said on X that the attack was not a “one-click” action, but rather a complex process. The investigation has not attributed responsibility to any individual nor found evidence of any wallet private key leak.

Binance said it would cover all losses from the company’s funds and an emergency assets fund, adding “user funds are safe.”

The crypto exchange said it had temporarily suspended deposits and withdrawals to allow security checks to be completed and blockchain intelligence partners to trace and recover funds. The crypto exchange expects withdrawal services to resume by Sunday morning.

Crypto-tracing firm TRM Labs attributed the heist to an elite North Korean hacking unit “based on robust on and off-chain intelligence,” pointing out that “several features of this attack match earlier North Korea-linked heists.”

Pangolin Intelligence, another blockchain-tracking firm based in Singapore, said it also believed that a North Korean hacking unit was behind the heist.“

Analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents,” an analyst with Pangolin Intelligence said, “led to the attribution.”

“I think the cat and mouse game has barely begun yet,” the Pangolin Intelligence analyst added, noting that North Korea was likely poised to tap a network of money laundering organizations to try to cash out the stolen funds.

Chainalysis, another crypto-tracking company, said it was monitoring stolen funds “moving across multiple blockchains,” including bitcoin and ethereum.

A Chainalysis spokesperson told reporters the firm had “high confidence” North Korea was behind the hack.Pyongyang has previously denied hacking allegations.

If North Korea is proven to be the culprit, it would be little surprise to US law enforcement officials and private experts. North Korean hackers were blamed for the previous record-high crypto hack, when they allegedly stole $1.5 billion from Bybit, another major cryptocurrency exchange.

In that case, the attackers stole an amount equal to a significant portion of North Korea’s reported annual gross domestic product in a matter of minutes.

North Korea’s formidable hacking teams are a key source of revenue for the nuclear-armed, sanctions-battered regime, according to current and former US and South Korean officials.

Pyongyang-linked hackers have stolen billions of dollars from banks and cryptocurrency firms in the last several years, according to reports from the United Nations and private firms.

Unlike platforms for trading stocks, cryptocurrency exchanges tend to hold digital assets on their users’ behalf, which make them more vulnerable to hackers and theft, particularly given a lack of regulatory oversight within the relatively nascent industry.

Binance was co-founded in 2017 by Canadian national Changpeng Zhao, becoming the world’s largest crypto trading platform within a year of its launch. However, Zhao stepped down in 2023 after pleading guilty to violating anti-money laundering laws in the US.

He was sentenced to four months in federal prison and was pardoned by President Donald Trump in October 2025.Zhao, who no longer manages the platform but remains its largest shareholder, said on X that he expects user funds to be fully covered by the exchange, pushing back against any suggestion to the contrary in a spat on X with Elon Musk.