North Korea-Linked Hackers Likely Behind $6.3 Billion Binance Theft

About $6.3 billion in cryptocurrency was stolen from Binance, the world’s largest crypto exchange, on Thursday in what CBS News and Al Jazeera described as the biggest crypto theft on record. TRM Labs put the amount at about $6.36 billion, taken from Binance wallets across ten blockchains, most of it in roughly 20 minutes, both outlets reported.

The previous record was the $1.5 billion theft from the Bybit exchange in February 2025, which the FBI attributed to a North Korean unit known as TraderTraitor, CBS and Al Jazeera reported. TRM says it has high confidence that the same unit, linked to the Lazarus Group, carried out the Binance attack, and Chainalysis reached a similar conclusion, according to CBS, CoinDesk and Al Jazeera. TRM also noted that the way the wallets were emptied mirrors the Bybit hack, Al Jazeera reported.

Binance has not blamed anyone. Al Jazeera quoted co-CEO Richard Teng saying the investigation has not attributed responsibility to any individual, and CBS reported that Binance’s statements did not name a perpetrator. CoinDesk quoted one investigator who said the attack was not yet definitively tied to Lazarus and that the attackers moved funds more slowly than North Korean actors typically do. North Korea routinely denies such accusations, Al Jazeera reported.

Binance’s account of how it happened has widened. Its first finding, reported by all three outlets, was a compromised laptop belonging to one engineer. CBS and Al Jazeera reported that a broader probe later found additional points of breach. Binance said it found no evidence that wallet private keys leaked, according to Al Jazeera; the former Mt. Gox chief Mark Karpeles told Reuters that the attackers probably accessed keys for at least two wallets, Al Jazeera reported.

On customers, CBS and Al Jazeera reported that Binance suspended withdrawals, said it would cover customer losses and is working with law enforcement. Both also reported that about $3 billion has been frozen, with Al Jazeera adding, citing Reuters, that more than $2.3 billion of that was frozen by the stablecoin issuers Tether and Circle. Reports differ on when withdrawals will resume: CBS said within a day or two, and Al Jazeera said within 45 hours.

Markets took a hit. Al Jazeera reported that bitcoin touched a six-week low of $76,368, ether fell more than 3% to a two-month low of $2,178, and Coinbase shares dropped 4.8%, though Coinbase said it was unaffected. CoinDesk reported that crypto liquidations jumped to $1.57 billion. None of the three outlets reported a new FBI or Treasury statement on the incident, and all of the attribution so far comes from private analysts rather than government investigators.