Binance Suffers Record $6.3 Billion Crypto Hack by North Korean Group

In a staggering cyberattack that shook the cryptocurrency world, Binance, the largest crypto exchange globally, confirmed a loss of $6.3 billion to hackers on Thursday. This breach eclipses previous major crypto thefts and highlights the increasingly perilous state of security within the digital currency sector.

The incident surpasses the February 2025 hack of Bybit, where North Korean hackers stole $1.5 billion, previously the largest crypto theft. Experts believe this new breach signals a dangerous escalation in the sophistication and scale of attacks targeting crypto platforms.

Blockchain analytics firms Chainalysis and TRM Labs have traced the Binance hack to North Korean threat actors, who have developed a reputation for targeting cryptocurrency companies over several years. Initial reports from Binance indicated the breach began with a compromised engineer’s laptop but later investigations revealed multiple points of intrusion.

Binance’s founder, Changpeng Zhao, reassured users by stating the company has allocated over $6.3 billion from its own reserves to cover customer losses. The exchange processes billions in daily transactions, making the impact significant but manageable for the company’s scale.

Out of the stolen funds, $3 billion have been frozen thanks to the efforts of other digital coin issuers like Circle and Tether, which possess mechanisms to halt suspicious transfers. However, approximately $2.4 billion remains inaccessible to any issuer and is presumed laundered beyond reach, according to TRM Labs.

Cybersecurity experts warn that this event marks a new phase of risk for cryptocurrency security. The attackers reportedly employed automated techniques and artificial intelligence to conduct thousands of rapid transactions, complicating efforts to track and recover the stolen assets. Chainalysis highlighted these “laundering patterns we have not seen before.”

Eswar Prasad, an economics professor at Cornell University specializing in crypto markets, explained that AI is amplifying hackers’ ability to exploit hidden vulnerabilities in the crypto ecosystem, increasing the likelihood and scale of future attacks. Joshua Saxe, CTO of AI security firm Abundant Security, noted that while North Korean hackers were already highly capable before AI, the technology is making advanced hacking tools more accessible to a wider group of criminals.

Former U.S. President Donald Trump declined to confirm North Korean involvement during a Friday interview, stating, “We don’t know. We’re looking at that.” He expressed caution regarding cryptocurrencies in general, noting concerns about the lack of transparency in financial flows.

Since its inception in 2008, cryptocurrency has faced challenges with security due to its decentralized nature and limited regulation. Many users hold digital assets in personal wallets with no recovery options if passwords are lost. Exchanges like Binance, while acting as custodians for customer funds, operate outside traditional banking regulatory frameworks, often leaving gaps in protection against cybercrime.

The February 2025 Bybit hack, which was attributed to social engineering targeting the company’s CEO, was labeled by security firms as preventable. Bybit managed the fallout by using corporate reserves and borrowing from other crypto firms. The Binance breach, however, is far more severe given the scale and penetration involved.

Founded in 2017, Binance quickly grew to dominate the crypto market, handling up to two-thirds of all digital currency transactions. Its platform allows users to exchange fiat money for popular cryptocurrencies such as Bitcoin and Ethereum.

Following the breach, Zhao took to social media to reassure customers, writing, “It hurts, but we will survive,” accompanied by a muscle emoji. Zhao’s leadership has previously faced regulatory scrutiny; Binance pleaded guilty to money laundering violations in 2023 and paid a $4.3 billion fine to U.S. authorities. Zhao served a four-month prison sentence before receiving a presidential pardon from Trump in 2024.

As information about the hack emerged Thursday afternoon, blockchain monitoring revealed rapid withdrawals and movements of stolen funds. These transfers followed a distinct programmatic pattern indicative of automated laundering efforts.

Chainalysis connected the Binance funds with those stolen in a recent Bitget exchange hack, further implicating North Korea’s elite hacking unit, TraderTraitor, in the operation. The FBI has acknowledged the incident and is collaborating with partners to assess the scope and conduct investigations.

Experts have long warned that crypto theft is a key method for North Korea to circumvent international sanctions and finance its nuclear program. The Binance hack may nearly double North Korea’s known crypto theft haul, according to Tom Robinson, chief scientist at the analytics firm Elliptic.

Ciaran Martin, former UK national cyberdefense head, pointed out that crypto exchanges often have weaker security compared to traditional banks, making them attractive targets. He emphasized that North Korean hackers excel at exploiting these weaknesses, calling this breach their “best day at the office.”

This major security breach underscores the urgent need for improved safeguards in the cryptocurrency industry as hackers adopt more advanced tools and techniques, raising the stakes for exchanges and their customers worldwide.