NEW YORK / CryptoWire.AI / – Hackers linked to North Korea have been blamed for stealing about $6.3 billion from Binance, the largest crypto theft ever recorded. The world’s biggest cryptocurrency exchange, co-founded by Chinese-born Canadian billionaire Changpeng Zhao, paused withdrawals after the breach late on Thursday, October 29. Binance said user funds were safe and pledged to cover all losses. It warned on X that the total may continue to increase as it traces and freezes more assets.
Blockchain analysis firms TRM Labs and Chainalysis said most of the theft happened in about 20 minutes. TRM reported that roughly $6.36 billion left Binance wallets on 10 blockchains. The sum is more than four times the $1.5 billion taken from the exchange Bybit in February 2025. About $3 billion has been frozen, including more than $2.3 billion by stablecoin issuers Tether and Circle, according to Reuters. The fate of the remaining $3.3 billion is unclear.
TRM said it had high confidence the attack was the work of TraderTraitor, a North Korean unit tied to the Lazarus Group. The Council on Foreign Relations says the group mainly targets South Korea for espionage and disruption, but also runs cyber operations for financial gain. The U.S. Treasury sanctioned the group in 2019, saying it was controlled by North Korea’s main intelligence bureau. Pyongyang routinely denies involvement in hacking.
Hacked laptop and more breach points
Binance first said the breach may have begun with a hacked laptop belonging to one of its engineers. On Friday, it said further investigation had found additional points of breach. The exchange said it found no evidence that private keys, the digital passwords that control crypto wallets, had leaked. Co-CEO Richard Teng said the investigation had not attributed responsibility to any individual. TRM said the attackers ordered Binance wallets to empty into their own wallets, mirroring the Bybit hack.
Mark Karpeles, the former head of the collapsed Tokyo exchange Mt. Gox, told Reuters the attackers probably accessed keys for at least two Binance wallets. Experts say stolen crypto gives North Korea much-needed foreign currency and helps fund its nuclear program. South Korea’s spy agency estimated in 2022 that North Korean hackers had stolen about $1.1 billion in virtual assets over five years. North Korean operatives have also posed as job applicants at U.S. firms such as Amazon.
Centralized exchanges face scrutiny
Bitcoin dropped to a six-week low of $76,368, and Ether slid more than 3% to $2,178, a two-month low. Coinbase shares fell 4.8%, though the exchange said it was unaffected. Markets steadied after the initial shock. Crypto was already under pressure from higher U.S. interest rates, analysts said. Earlier this year, Bitcoin tested $73,000 as liquidations swept crypto markets. The stolen sum is also more than six times Binance’s $1 billion emergency fund for users.
Sean Foley, a crypto markets expert at Macquarie University in Sydney, told Al Jazeera that assets on a centralized exchange are only as safe as the exchange itself. Most crime and cyber insurance policies do not cover stolen crypto. Hackers stole $2.87 billion in nearly 150 attacks in 2025, according to TRM. Binance said it was working with law enforcement and remained on track to resume withdrawals within 45 hours of its Friday update.