Investigators Say North Korea Drained $6.3 Billion From Binance in 20 Minutes Through One Engineer's Laptop

On Thursday, attackers hit Binance wallets on 10 blockchains and moved most of the money in about 20 minutes. By the exchange's own estimate, the damage came to around $6.3 billion.

"It's the biggest hack in history," said Aravind Srinivasan of GSR. Blockchain investigators already have a suspect. TRM Labs says several features of the attack match earlier North Korea-linked heists, including the 2025 Bybit hack the FBI attributed to Pyongyang. "We make this judgment with high confidence," the firm said.

Chainalysis also linked the theft to North Korea, and investigators named the group as TraderTraitor. That attribution comes from analysts, not from Binance or any government. North Korea's mission in Geneva and its embassy in China did not respond to Reuters.

For scale, TRM counted $2.9 billion stolen across nearly 150 attacks in all of last year. This one theft is more than double that.

One laptop, then more

Binance's first explanation was startlingly small. Late Thursday, it said a compromised DevOps engineer's laptop may have let an attacker reach a service container and submit unauthorized withdrawal transactions. "We have found no evidence of any wallet private key leak," the company said.

By Friday the story had grown. "Our subsequent investigation has uncovered additional points of breach," Binance said. CEO Richard Teng pushed back on the idea that a single person's access explained it, saying the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action." He added: "Our investigation has not attributed responsibility to any individual."

Binance has promised a technical post-mortem and an updated Proof of Reserves.

The race for the money

Roughly $3 billion has been frozen with the help of partners. Tether locked nearly $1.57 billion and Circle more than $800 million. Ripple froze about $200 million. World Liberty Financial, the crypto venture linked to the Trump family, also froze funds with BitGo, which Binance co-founder Yi He put at $27 million in stablecoins and about $2 million in WLFI tokens.

The rest is harder to reach. Arkham, whose own count puts the theft a little lower at $6.01 billion, estimates about $2.9 billion can still be moved. The attacker keeps moving it, sending $38.82 million in ETH to a new address on Friday while holding $1.12 billion in ETH.

Stolen crypto of this kind tends to end up with professionals. After Bybit, investigator ZachXBT fronted $350,000 to go undercover with the Chinese launderers who move North Korea's loot.

Who pays

Binance says user funds are safe and that it will cover all losses from SAFU, its emergency reserve held in bitcoin, along with company funds. Yi He promised to cover "all hacking losses." The exchange has 335 million registered users and reported about $162.8 billion in assets under custody in its 2025 annual report.

Deposits returned to normal on Friday. Withdrawals stayed suspended while Binance revamps the security of its withdrawal service, and are expected back within about 45 to 48 hours. Binance.US and Coinbase were not affected.

The market took the hit anyway. Bitcoin fell more than 3% to a six-week low of $76,368, ether lost more than 3% to $2,178 and BNB dropped 5% to $709.70. Coinbase shares slid 4.8% and Strategy nearly 6% in extended trading.

The heist also lands weeks after Bitget lost about $350 million in September. "It's becoming very hard to counter hacks as AI can find vulnerabilities faster than you can fix them," said Bernardo Brites of Trace Finance.

Some offers on this page may be paid placements or contain affiliate links.