In brief
TRM Labs says North Korean hackers, likely the TraderTraitor group, stole $6.36 billion from Binance in a record heist that moved assets across ten blockchains in about 20 minutes. Binance has pledged to cover losses from its own reserves and is working to recover the stolen funds. The FBI is aware of the incident and is coordinating with partners, while $2.7 billion of the stolen assets have been frozen and $2.4 billion remain in custody of the hackers.
North Korean hackers are being blamed for a $6.36 billion cryptocurrency theft from Binance, the world’s largest crypto exchange, in what would be the biggest digital‑asset heist on record, a U.S. blockchain intelligence firm said Thursday.
According to TRM Labs, the theft was likely carried out by the TraderTraitor group, reported to have moved assets across ten blockchain networks in about 20 minutes. The firm noted that the hackers had been preparing for at least 36 hours beforehand and had gained access to systems used to authorize transfers.
TRM Labs said it has “high confidence” in its attribution, citing transaction analysis and similarities to prior North Korean operations. The firm also reported that about $2.7 billion of the stolen assets have been frozen through cooperation among crypto companies and blockchain operators, while the hackers still control roughly $2.4 billion worth of Bitcoin and Ethereum.
Richard Teng, co‑CEO of Binance, wrote on X that the company is “working non‑stop” to resolve the issue. “We are committed to covering all hacked losses through our company funds. Your assets are safe,” he said. “We have reserved over $6.34 billion of company funds to cover the stolen assets; $5 billion of those funds are already held in the exact token assets that were impacted.”
The U.S. Federal Bureau of Investigation has said it is aware of the incident and is coordinating with partners to understand the scope of the activity. The heist would far exceed the $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025, also attributed to TraderTraitor by the FBI.
U.S. officials have indicated that North Korea exploits networks of its nationals abroad and foreign facilitators, including in China, Russia, Cambodia and Vietnam, to launder stolen digital assets into fiat currency for procurement and weapons‑of‑mass‑destruction funding.
