Binance Loses $6.36 Billion in Largest Crypto Heist on Record

Cryptocurrency markets are reeling after the world’s largest exchange confirmed a massive security breach that resulted in the theft of billions of dollars. Binance announced early Friday that a complex attack had compromised its systems, marking the most significant financial loss in the history of digital currency trading.

Blockchain intelligence firm TRM reported that an attacker moved approximately $6.36 billion US out of Binance wallets across 10 different blockchains. The transfer occurred in a rapid burst, with the majority of the funds moving in about 20 minutes. TRM identified the perpetrator as TraderTraitor, a hacking unit based in North Korea. The firm stated it made this judgment with high confidence, noting that several features of the attack matched the 2025 Bybit hack, which cost that exchange $1.5 billion.

Binance disclosed that the incident involved a compromised laptop, though further investigation revealed additional points of breach. The company said it had frozen roughly $3 billion US in affected assets by working with blockchain partners. Deposits remained open during the incident, but withdrawals are currently suspended and are expected to resume within one to two days. The exchange stated it would cover all losses incurred by users.

Changpeng Zhao, the Canadian founder of Binance, posted on social media that user funds were safe. Although Zhao stepped down as CEO in 2023 after pleading guilty to a felony related to money laundering prevention, he remains a shareholder. He stated that he expects all user funds to be fully covered. President Donald Trump pardoned Zhao in 2025.

Jonathan Levin, co-founder and CEO of Chainalysis, also attributed the hack to the DPRK group TraderTraitor. A Binance spokesperson said the company was working with law enforcement partners to confirm the identity of the criminals. Experts note that North Korea has increased its use of cybercrime to generate foreign currency for its economy and nuclear program, particularly after UN sanctions limited other revenue streams.

Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, said the attack appeared to involve a single signature that granted the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets are connected to the internet and hold the private keys required to authorize transactions. Binance said it found no evidence of a wallet private key leak and plans to release more technical details when its investigation concludes.