North Korea Linked to $6.3 Billion Binance Crypto Heist

What happened

Binance, the world's largest cryptocurrency exchange, says hackers stole about $6.3 billion from its wallets, in what looks like the biggest crypto heist on record. The company suspended deposits and withdrawals on Thursday and said it would cover all losses, telling Al Jazeera that user funds were "safe".

Two US blockchain analysis firms, TRM Labs and Chainalysis, say most of the theft unfolded in about 20 minutes, starting late on Thursday. TRM reported that an attacker moved about $6.36 billion out of Binance wallets across 10 blockchains. That dwarfs the previous record: $1.5 billion stolen from the exchange Bybit in February 2025.

About $3 billion has since been frozen, including more than $2.3 billion by stablecoin issuers Tether and Circle, according to Reuters. Binance has not said what happened to the remaining $3.3 billion, and warned on X that the $6.3 billion figure "may continue to increase" as it traces and freezes more assets.

TRM assessed with "high confidence" that the attack was carried out by TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. Chainalysis reached the same conclusion. Binance itself has been more cautious. Co-CEO Richard Teng said on X that its investigation "has not attributed responsibility to any individual".

Why it matters

The scale is hard to overstate. The stolen sum is more than six times Binance's $1 billion emergency fund, the Secure Asset Fund for Users, set up in 2018 and held entirely in Bitcoin. Teng said company funds would also cover losses, but the heist still exposed a weak point at the heart of crypto: large, centralised exchanges hold users' assets on their behalf, so they become bigger targets as they grow.

Markets felt it at once. Bitcoin hit a six-week low of $76,368, while Ether fell more than 3 percent to a two-month low of $2,178. Shares in Coinbase, which said it was unaffected, fell 4.8 percent. The hack landed as crypto was already under pressure from higher US interest rates and weaker demand from exchange-traded fund buyers, analysts told Reuters.

It also fits a wider pattern. Hackers stole $2.87 billion in crypto in nearly 150 attacks in 2025, according to TRM's 2026 Crypto Crime Report. And North Korean hacking is not a new threat to US firms: the Justice Department has previously charged that [North Korean IT workers infiltrated dozens of US firms](/article/doj-north-korean-it-workers-infiltrated-dozens-of-us-firms), while US systems from election infrastructure onward remain a target, as shown when [hackers targeted FEC systems days before the midterms](/article/hackers-target-fec-systems-before-midterms).

What it means for the US

For US readers, this is a security story as much as a markets story. The US Treasury sanctioned the Lazarus Group in 2019, saying it was controlled by North Korea's primary intelligence bureau, and the FBI blamed the same unit for the 2025 Bybit hack. TRM's global head of policy, Ari Redbord, put the stakes bluntly to Al Jazeera: "When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity. That makes this a global security issue, not just a crypto theft."

North Korea routinely denies involvement in hacking. Experts say crypto theft has become a much-needed source of foreign currency for Pyongyang, helping prop up its economy and fund its nuclear programme, which is under United Nations sanctions. South Korea's spy agency estimated in December 2022 that North Korean hackers had stolen about 1.5 trillion won ($1.1 billion) in crypto and other virtual assets over five years.

There is a practical warning for US crypto holders too. Sean Foley, a crypto markets expert at Macquarie University, told Al Jazeera that any assets held at a centralised exchange "are only as safe as the exchange itself". Insurance offers limited protection, because most crime and cyber policies do not cover stolen cryptocurrency.

What happens next

Binance said on Friday it was coordinating with law enforcement and remained on track to resume withdrawals within 45 hours. The open questions are whether more of the $3.3 billion still missing can be frozen before it is laundered, and whether US authorities publicly attribute the attack, as the FBI did after Bybit.

Binance also said its investigation had uncovered "additional points of breach" beyond the hacked engineer laptop it first pointed to, and that it had found no evidence any wallet's private key had leaked. Former Mt Gox head Mark Karpeles told Reuters the attackers had probably accessed keys for at least two Binance wallets. That disagreement will matter: how the attackers got in decides what other exchanges need to fix.