Hackers stole around $6.36 billion in cryptocurrency from wallets held by Binance, the world's largest cryptocurrency exchange, in what investigators have described as the biggest crypto theft on record. Blockchain intelligence firms have linked the attack to North Korea's elite hacking unit. Binance has assured users that their funds remain safe and pledged to cover all losses.

According to US-based blockchain analysis firm TRM Labs, the attackers moved the stolen cryptocurrency across 10 blockchains, completing most of the transfers within 20 minutes. Around $3 billion had been frozen by Thursday night in the US, CNN reported.

Binance CEO Richard Teng said the attack was more complex than initially believed. He also clarified that investigators had found no evidence of a wallet private key leak.

TRM Labs said, "An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes."

Binance's initial investigation suggested that an engineer's laptop was compromised. This allegedly allowed the attacker to access a service container and initiate unauthorised withdrawal transactions.

However, Teng rejected the suggestion that the attack involved a single employee's access. "The attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," he said, according to Reuters. He described it as a more "complicated attack process".

Teng added that the investigation had not identified any individual as responsible. Binance said it had suspended deposits and withdrawals temporarily, revoked the affected address authorisation and contacted law enforcement and blockchain intelligence partners to trace the stolen funds.

Co-founder and former CEO Changpeng Zhao also said he expected the exchange to cover all user losses. Zhao, who stepped down in 2023 but remains Binance's largest shareholder, described the incident as a hack on X.

TRM Labs attributed the attack to TraderTraitor, an elite North Korean hacking unit, based on intelligence gathered from on-chain and off-chain sources.

"TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on- and off-chain intelligence. We make this judgment with high confidence," the firm said, according to Reuters.

Singapore-based Pangolin Intelligence and blockchain analysis firm Chainalysis also pointed towards North Korea. Chainalysis told CNN it had "high confidence" that North Korea was behind the attack.

However, private intelligence firms have not yet established this attribution as a confirmed law enforcement finding.

North Korean hacking groups have repeatedly faced accusations of stealing cryptocurrency and targeting financial institutions. In February 2025, hackers from the country were blamed for stealing $1.5 billion from cryptocurrency exchange Bybit, setting the previous record for the largest crypto heist.

A 2023 CNN investigation also highlighted efforts by South Korean intelligence officials and private experts to recover around $1 million in cryptocurrency stolen by North Korean hackers.

Binance has pledged to cover the losses through its Secure Asset Fund for Users (SAFU) and company funds. "Binance will cover all losses from the SAFU fund and company funds," the exchange said, according to Reuters. Teng also assured users that the company was "covering every loss".

Meanwhile, blockchain firms are tracking the stolen assets to prevent further transfers and attempts to convert them into cash. A Pangolin Intelligence analyst told CNN, "I think the cat and mouse game has barely begun yet."

The analyst warned that North Korea could use money-laundering networks to cash out the stolen cryptocurrency.

The breach also affected market sentiment. Bitcoin and Ether fell after news of the attack but recovered some losses. Both were trading around 2-3 per cent lower by midday Friday in Hong Kong.