North Korean hackers are suspected of carrying out the largest cryptocurrency heist on record, following a cyberattack on crypto exchange Binance. More than $6 billion in digital assets were removed from Binance wallets, mostly within a 20-minute window.
In a post on X, Binance said the criminals gained access to its network by compromising a single engineer’s laptop. From there, they accessed a service container and initiated unauthorized withdrawals, using 50 pre-signed authorizations they had prepared in advance to execute the transactions.
Containing the Damage
The breach was remarkably extensive, affecting wallets across the XRP Ledger, Ethereum, Bitcoin, Tron, and Solana networks. A second wave of attacks targeted wallets on Avalanche and Polygon.
Still, the damage could have been greater. Roughly half of the stolen assets were frozen as they moved across various blockchains. Binance also said its private keys were not compromised, which could have given the criminals near-total control over the company’s crypto holdings.
According to its 2025 annual report, Binance holds more than $160 billion in digital assets in custody. The exchange pledged to make all customer funds whole. It has suspended withdrawals but expects to restore the service within 48 hours of the breach.
The Hackers’ Attacks
Blockchain analysis firm TRM has attributed the attack to TraderTraitor, a North Korean hacking group. The FBI identified the same group as responsible for the $1.5 billion theft from Bybit in February 2025, which previously held the record for the largest cryptocurrency heist.
TraderTraitor is a subgroup of the Lazarus Group, a cybercriminal network believed to be sponsored by the North Korean government. Along with Russia, China, and Iran, North Korea is considered one of the four leading state-sponsored cyber threats. The government uses these networks to collect intelligence, launch disruptive attacks around the world, and generate revenue to circumvent the economic sanctions imposed on the country.
Beyond the Bybit theft, TraderTraitor has also been linked to a breach at cryptocurrency exchange Bitget, in which more than $350 million in digital assets were transferred without authorization. That attack followed a similar pattern, with criminals compromising a critical backend system within Bitget’s wallet infrastructure.