North Korean Hackers Linked to Record $6.3B Binance Crypto Heist

A cyberattack targeting Binance has resulted in what security researchers describe as the largest cryptocurrency theft in history, with hackers allegedly linked to North Korea stealing at least $6.3 billion from the world’s largest crypto exchange.

According to blockchain security researchers, nearly half of the stolen funds, worth approximately $3 billion, have already been frozen with help from industry partners. However, investigations are still ongoing, and the final amount involved in the breach could change.

The incident has raised serious concerns about cryptocurrency exchange security, particularly how attackers were able to gain access to systems connected to billions of dollars in digital assets.

Binance Identifies Compromised Employee Laptop as Entry Point

In an update shared on X, Binance said its initial investigation identified a compromised laptop belonging to one of its engineers as the possible entry point for the attack.

According to the exchange, the attackers used the compromised device to access a service container within its network. This access allowed them to submit unauthorized withdrawal transactions and move cryptocurrency out of the company’s wallets.

Binance also said it had found no evidence suggesting that its private keys were exposed during the incident. Private keys are critical security credentials that provide control over cryptocurrency wallets and their stored assets.

Following the discovery, Binance suspended deposits and withdrawals while its security teams continued investigating the breach. The exchange had already paused withdrawals across several blockchains, as previously reported by TechCrunch.

Binance maintained that customer funds were safe but did not immediately provide supporting evidence. The company said it plans to release an updated proof of reserves after completing its recovery and remediation efforts.

Around $3 Billion in Stolen Crypto Frozen

Binance spokesperson Andie Cooper confirmed in a statement shared with TechCrunch on Friday that industry partners had helped freeze approximately $3 billion worth of stolen cryptocurrency.

The company has also started recovering affected assets for users. According to Cooper, Binance is working alongside law enforcement agencies, cryptocurrency issuers, blockchain intelligence companies and other industry partners to track the remaining funds.

The recovery effort focuses on identifying transactions, freezing assets wherever possible and preventing the attackers from moving additional cryptocurrency through different blockchain networks.

Despite these efforts, questions remain about how the attackers managed to compromise an employee’s laptop and gain access to sensitive internal systems.

How Could a Single Laptop Lead to Such a Massive Attack?

The incident has highlighted the risks associated with compromised employee devices and software supply chains.

Modern software applications are built using multiple components, including open-source libraries and third-party tools. Cybercriminals frequently target these components, sometimes modifying legitimate software to distribute malicious code.

Another common technique involves hiding malware inside applications or games that appear legitimate. Once installed, this malware can collect usernames, passwords and session tokens from an infected computer.

Attackers may then use these stolen credentials to access company systems while appearing to be authorized employees.

Binance will likely face questions about why a single engineer’s compromised laptop had access to systems capable of processing cryptocurrency withdrawals worth billions of dollars.

There are also questions about the exchange’s security testing practices. TechCrunch contacted Binance to ask whether an independent third-party security company had audited or tested its network and internal systems before the attack. The company did not immediately respond to those questions.

Independent security audits and penetration testing are commonly used by companies to identify weaknesses before cybercriminals can exploit them.

Researchers Point to North Korean Hacker Group TraderTraitor

Blockchain intelligence firm TRM Labs attributed the attack to North Korean hackers and described the incident as the largest cryptocurrency hack on record.

According to researchers, the attackers are associated with a hacking network known in the cybersecurity industry as TraderTraitor. The group is believed to focus primarily on stealing cryptocurrency from major exchanges and financial companies.

TraderTraitor has previously been linked to another major cryptocurrency theft involving Bybit in 2025. That incident resulted in approximately $1.4 billion in stolen digital assets and was previously considered the largest known crypto heist.

TRM Labs also reported that the Binance attack happened extremely quickly, with the theft of billions of dollars in cryptocurrency taking approximately 20 minutes.

Blockchain security company Elliptic separately attributed the Binance breach to North Korean hackers. Its researchers identified connections between some of the stolen funds and a wallet previously associated with an attack on cryptocurrency exchange Bitget earlier this year. That incident involved approximately $351 million in stolen funds.

North Korea’s Continued Focus on Cryptocurrency Theft

The latest incident has renewed concerns about cyber operations connected to North Korea.

The United States and its allies have repeatedly warned about hacking activities associated with the country, which remains largely cut off from the US and international financial systems because of its nuclear weapons development program.

Security researchers have long argued that cryptocurrency theft provides North Korea with an alternative way to obtain funds despite international sanctions.

According to researchers, stealing digital assets from major cryptocurrency companies has become an important source of funding for the isolated country, potentially supporting its sanctioned weapons programs.

Binance Faces Growing Security Questions

Although Binance says it is working to recover the affected assets and protect customer funds, the breach raises important questions about internal security controls, employee device protection and withdrawal authorization systems.

The ability of attackers to use a compromised employee laptop to access sensitive infrastructure highlights the importance of stronger security measures across cryptocurrency platforms.

For now, Binance’s investigation and asset recovery efforts remain ongoing. The exchange has promised to publish an updated proof of reserves once remediation is complete, while blockchain security firms and industry partners continue tracking the stolen cryptocurrency.

Also read : Bluesky Blocks Links to Leaked DHS Employee Data Website