Binance, the world’s largest cryptocurrency exchange, said on Oct. 30 that hackers made off with approximately $6.3 billion in digital assets, a sum Yonhap reported as $6.36 billion citing blockchain intelligence firm TRM Labs. Investigators have linked the breach to TraderTraitor, a hacking group tied to North Korea, in what analysts describe as the largest cryptocurrency theft ever recorded.

- Binance disclosed on Oct. 30 that roughly $6.3 billion in crypto was stolen, with Yonhap citing TRM Labs at $6.36 billion, the largest such theft on record
- TRM Labs says the group known as TraderTraitor took funds across 10 blockchain networks, with most of the haul moved in about 20 minutes after roughly 36 hours of preparation
- Around $2.7 to $3 billion of the stolen assets have reportedly been frozen through cooperation among crypto firms, while about $2.4 billion in Bitcoin and Ethereum remained with the hackers, per Yonhap
- Chainalysis says North Korea had already stolen at least $6.75 billion in crypto through the end of 2025, and researcher Michael Barnhart puts the regime's cumulative total near $13.5 billion after the Binance hack
- Bitcoin fell about 4% to the $78,000 range, its lowest in a month, and South Korea's Upbit warned users about withdrawals tied to Binance, BusinessKorea reported
What happened
According to TRM Labs, the attackers spent at least 36 hours preparing before striking, ultimately pulling funds from 10 separate blockchain networks and moving most of the stolen assets within roughly 20 minutes. The firm said it believes the hackers gained entry to systems that authorize cryptocurrency transfers, and BusinessKorea reported that the intrusion traced back to an unauthorized withdrawal path accessed through an engineer’s laptop. TRM Labs also raised the possibility that the signature system behind Binance’s internet-connected hot wallet had been compromised.
Binance halted deposits and withdrawals while reviewing its security and said customer funds remained safe, pledging to cover losses using insurance reserves and company funds. Co-CEO Richard Teng wrote on social media platform X that the exchange was working continuously to resolve the situation. Industry-wide cooperation has reportedly frozen between $2.7 billion and $3 billion of the stolen assets, according to TRM Labs and Binance, though Yonhap reported that hackers still held about $2.4 billion worth of Bitcoin and Ethereum, with concerns they could attempt to obscure the funds by shifting them across platforms and networks.
Why it matters
The theft dwarfs North Korea’s previous record haul, the $1.5 billion taken from exchange Bybit in February 2025, which U.S. authorities also attributed to TraderTraitor. Cybersecurity experts told Straits Times that proceeds from such thefts help finance North Korea’s weapons programs. The shock rippled through markets: Bitcoin dropped about 4% to the $78,000 range, its weakest level in a month, while stablecoin issuers Tether and Circle moved to freeze tokens tied to Binance, BusinessKorea reported. South Korea’s largest exchange, Upbit, told users to be cautious with transfers to Binance amid the fallout.

Background
TraderTraitor first drew formal attention in a 2022 joint advisory from the FBI, CISA and the U.S. Treasury, which detailed how the group used malicious software, bogus job postings and fake interviews to infiltrate developers and IT staff at crypto firms, extracting login credentials and sensitive data. Researcher Michael Barnhart of DTEX described the unit as North Korea’s most capable hacking operation, staffed by veterans of the regime’s former APT38 cyber ranks. Beyond Bybit, the group was also tied to a $387 million theft from exchange Bitget in September, and Chainalysis reported that North Korea had stolen at least $6.75 billion in crypto through the end of 2025 alone. Barnhart estimates the country’s cumulative crypto theft now stands near $13.5 billion. Yonhap noted that U.S. officials have previously said North Korea relies on overseas nationals and facilitators in countries including China, Russia, Cambodia and Vietnam to convert stolen assets into usable currency.
What to watch
Attention now turns to whether the roughly $2.4 billion still in hackers’ hands can be tracked or frozen before it is laundered through additional networks. Binance’s compensation process and the outcome of its security review will likely shape user confidence, while South Korea has seen separate incidents, including a breach of customer data at Bithumb and a smaller theft of around 100 million won, roughly $75,000, in virtual assets, according to BusinessKorea. Our read: the scale and speed of this attack suggest exchange security measures may need to evolve faster than the threat posed by state-linked hacking groups.
Frequently asked questions
How much was stolen from Binance?
Binance said on Oct. 30 that the theft totaled about $6.3 billion, while Yonhap reported blockchain firm TRM Labs put the figure at $6.36 billion, making it the largest crypto theft on record.
Who is blamed for the hack?
Blockchain investigators TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking group also linked to the 2025 Bybit and Bitget hacks.
Has any of the stolen money been recovered?
Binance and partner firms say they have frozen between roughly $2.7 billion and $3 billion of the stolen funds, though around $2.4 billion in Bitcoin and Ethereum reportedly remained under the hackers' control, according to Yonhap.
Sources
- The Straits Times: North Korean hackers linked to crypto thefts among world's best, experts say
- The Straits Times: North Korean hackers linked to crypto thefts among world’s best, experts say
- BusinessKorea: North Korea-Linked Group Suspected to Hit Binance with Massive Hack
- Yonhap News: (LEAD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm
This article was prepared with AI assistance from the reports listed above and automatically checked against them. See About for how we work.











