Binance Hit By Record Crypto Hack. Investigators Are Pointing at North Korea.

Cryptocurrency exchange Binance has been hit by an estimated $6.3 billion cyberattack, potentially the largest crypto theft on record. Blockchain investigators linking the breach to North Korean hackers.

The attack involved unauthorized transfers from Binance-controlled wallets across 10 blockchain networks. Most of the stolen assets were moved within roughly 20 minutes, according to TRM Labs, which traced approximately $6.36 billion in transactions.

Binance confirmed the security breach Friday and said it had worked with blockchain partners to freeze approximately $3 billion in affected assets. The exchange pledged to cover customer losses using its Secure Asset Fund for Users, known as SAFU, and company resources.

The scale of the attack exceeds the $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025, previously the largest known crypto heist.

The Federal Bureau of Investigation attributed that theft to TraderTraitor, a North Korean hacking group that has targeted cryptocurrency businesses.

TRM Labs has now linked the Binance attack to the same group, citing its analysis of blockchain transactions and other intelligence. However, the company has not publicly identified the perpetrators, and the investigation remains ongoing.

The exchange initially said the breach may have involved a compromised laptop belonging to a DevOps engineer, potentially allowing attackers to access a service container and initiate unauthorized withdrawals.

But subsequent investigations uncovered additional points of compromise, indicating that the attack involved a more complicated process.

In its official security update, Binance said investigators had found no evidence that wallet private keys were leaked. These keys are digital credentials used to authorize cryptocurrency transactions.

The company has not yet established the full sequence of events and said it would release a detailed technical report once its investigation is complete.

TRM Labs' analysis found that the attackers had prepared parts of the operation at least 36 hours before the theft, setting up computer code and testing transactions ahead of the main attack.

The stolen assets included Bitcoin, Ether and several stablecoins, which are cryptocurrencies designed to maintain a fixed value, typically against the U.S. dollar.

Ethereum accounted for approximately $3.79 billion of the transfers, while Bitcoin represented another $1.47 billion. Other affected networks included Tron, Solana and the XRP Ledger.

The attackers also exploited a feature of Ethereum known as EIP-7702, which allows a wallet to authorize software that can execute transactions on its behalf.

TRM Labs found that the attackers used preauthorized transactions to gain control of a Binance wallet and transfer its holdings to addresses they controlled.

The security firm said the activity across multiple blockchains pointed to a possible compromise of Binance's transaction-signing infrastructure, although the exchange has not confirmed that explanation.

Efforts to stop the stolen funds from moving began shortly after the attack was detected. Stablecoin issuers including Tether and Circle froze large quantities of affected tokens, preventing them from being transferred or exchanged. Ripple and other blockchain organizations also participated in the response.

TRM Labs identified approximately $2.7 billion in frozen assets during its initial investigation, while Binance later confirmed a higher total of around $3 billion.

Freezing cryptocurrency prevents further movement of the affected assets but does not necessarily mean the funds have been returned to their owners.

The attackers had already converted some of the stolen stablecoins into other digital currencies before restrictions could be imposed.

TRM Labs said the perpetrators exchanged large amounts of stablecoins for Ether through decentralized trading platforms, while other funds were moved through lending services.

The firm identified more than 420,000 Ether and 18,270 Bitcoin, worth approximately $2.4 billion at the time of its analysis, in assets beyond the direct freezing powers of stablecoin issuers.

The incident also disrupted Binance's services. The company initially suspended deposits and withdrawals while conducting security checks. In a subsequent service update Friday, it said deposits were operating normally but withdrawals remained paused while it strengthened security controls.

Binance said it expected withdrawals to resume within 48 hours of that update, although it had not announced a firm reopening time.

The exchange is working with law enforcement agencies and blockchain intelligence companies to trace the remaining assets and identify those responsible.

It also plans to publish an updated proof-of-reserves statement after completing its security work. The statement is intended to show the digital assets held by the exchange against customer balances.

Binance has not provided a final estimate of the amount it expects to recover, while investigators continue monitoring cryptocurrency held in wallets associated with the attack.