Blockchain firm links North Korea to $6.3B Binance hack

A U.S.-based blockchain intelligence firm has linked North Korea's TraderTraitor unit to a massive hack that impacted more than $6 billion on Binance, the world's largest cryptocurrency exchange. The incident, which occurred in February 2026, involved an attacker moving approximately USD 6.36 billion out of Binance wallets across ten blockchains in about 20 minutes. TRM, the firm, stated that the attack was likely carried out by North Korea's elite hacking unit, TraderTraitor, and described it as the largest cryptocurrency theft on record.

Binance has taken immediate action, working with blockchain partners to freeze roughly $3 billion in affected assets and beginning the recovery of user funds. The exchange confirmed that deposits were unaffected, while withdrawals have been suspended but are expected to resume within the next day or two. Binance CEO Changpeng Zhao (CZ) posted on X that user funds are safe and that the theft appears to be a hack, though he does not manage the company anymore.

The FBI has previously linked North Korea and TraderTraitor to the Bybit hack, which resulted in a $1.5 billion loss. Experts note that North Korea has increasingly turned to cryptocurrency hacking to fund its economy and nuclear program amid U.N. sanctions. In December 2022, South Korea's spy agency reported that North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in cryptocurrency over five years, with more than half in 2022 alone.

The attack's signature, including a never-expiring full-access token to a Binance hot wallet, suggests sophisticated planning. NyxLab cybersecurity cofounder Kok Tin Gan highlighted this as a key indicator of the attack's origin. While Binance has found no evidence of a wallet private key leak, the company plans to release more technical details after its investigation is complete.

Source: NPR News