🇰🇵 North Korean hackers just pulled off the largest cryptocurrency theft in history, stealing roughly $6.36 billion from Binance in just 20 minutes.
Blockchain intelligence firm TRM Labs has linked the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking group associated with the notorious Lazarus Group.
The attackers reportedly drained Binance wallets across 10 blockchains, stealing approximately $3.79 billion from Ethereum, $1.47 billion in Bitcoin, $628 million from Tron and $296 million from the XRP Ledger.
The scale of the operation is staggering, with the amount stolen roughly four times greater than the $1.5 billion Bybit hack in February 2025, which was also attributed to North Korean hackers.
Binance's preliminary investigation suggests the attackers compromised an engineer's laptop, gaining access to systems used to authorize withdrawals rather than directly stealing wallet private keys.
On Ethereum, investigators found that attackers used 50 signed authorizations to gain control of a Binance wallet, allowing them to drain funds and intercept subsequent deposits.
More remarkably, that access reportedly remained active for nearly four hours, including more than 90 minutes after Binance suspended withdrawals.
The exchange has pledged to cover losses using its emergency SAFU fund and company reserves.
Meanwhile, cryptocurrency companies have reportedly helped freeze approximately $3 billion of the stolen assets, although billions remain outside their control.
Source: TRM Labs, @binance
Blockchain intelligence firm TRM Labs has linked the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking group associated with the notorious Lazarus Group.
The attackers reportedly drained Binance wallets across 10 blockchains, stealing approximately $3.79 billion from Ethereum, $1.47 billion in Bitcoin, $628 million from Tron and $296 million from the XRP Ledger.
The scale of the operation is staggering, with the amount stolen roughly four times greater than the $1.5 billion Bybit hack in February 2025, which was also attributed to North Korean hackers.
Binance's preliminary investigation suggests the attackers compromised an engineer's laptop, gaining access to systems used to authorize withdrawals rather than directly stealing wallet private keys.
On Ethereum, investigators found that attackers used 50 signed authorizations to gain control of a Binance wallet, allowing them to drain funds and intercept subsequent deposits.
More remarkably, that access reportedly remained active for nearly four hours, including more than 90 minutes after Binance suspended withdrawals.
The exchange has pledged to cover losses using its emergency SAFU fund and company reserves.
Meanwhile, cryptocurrency companies have reportedly helped freeze approximately $3 billion of the stolen assets, although billions remain outside their control.
Source: TRM Labs, @binance
