A notorious North Korean hacking group is reportedly behind an unprecedented $6.3 billion theft from Binance, the world’s largest cryptocurrency exchange.
The attack unfolded in about 20 minutes on Thursday evening, according to an analysis from TRM Labs.
Binance said the attack may have started with a compromised DevOps engineer’s laptop, which gave the attacker access to a service container where they submitted unauthorized withdrawal transactions.
“Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” the exchange said. “This was a complex attack.”
Evidence suggests the attackers did not steal private keys, but instead took control of the system that decides what Binance’s hot wallets sign.
“The most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains,” TRM said.
Binance quickly paused withdrawals and is working with law enforcement and blockchain partners to trace the stolen funds. “Your money is safe and we’re covering every loss,” co-CEO Richard Teng said on X.
Totaling an estimated $6.3 billion stolen, the attack is the largest crypto theft on record, about four times the $1.5 billion stolen from Bybit in February 2025.
About $3 billion of the stolen funds has been frozen so far, as stablecoin issuers including Tether and Circle blocked tokens held in the attacker’s wallets.
The attacker still controls more than $2.4 billion in ether and bitcoin, plus smaller amounts on other networks, according to TRM.
All signs point to Pyongyang
TRM attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored unit the FBI blamed for the 2025 Bybit theft. TraderTraitor is often grouped under the Lazarus Group umbrella.
“Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst,” TRM said.
North Korea routinely denies involvement in such attacks, Reuters reported.
The risk here is not limited to crypto, Jayant Dave of Check Point told the BBC. He said banks and other institutions whose automated systems move money or data on instruction face the same threat.
“The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign,” Dave said. “That’s the lesson: a strong vault doesn’t matter if someone controls the process that opens it.”
TRM advised organizations to separate signing systems and approval paths by wallet tier, treat requests for large batches of signatures as a sign of compromise, and keep a tested, pre-approved way to revoke access.
