Blockchain analysis firm TRM says North Korea behind $6.3 billion Binance crypto theft

U.S. blockchain analysis firm TRM Labs has attributed a massive raid on the cryptocurrency exchange Binance to North Korea, specifically identifying the elite hacking unit TraderTraitor. TRM Labs stated that an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, with most of the movement occurring within 20 minutes. CoinDesk reported that security researchers suggested the Lazarus Group may also be behind the nearly $6 billion hack.

Binance confirmed that US$6.3 billion in funds were impacted, an event described by Straits Times Business as the largest crypto theft on record. The exchange has temporarily suspended all deposits and withdrawals. According to Straits Times Business, Binance has worked with blockchain partners to freeze approximately US$3 billion in affected assets on-chain, though The Hindu - Sci-Tech reported the company indicated more than $2.5 billion had been frozen. Binance stated it will cover all losses and that user funds are safe.

Estimates regarding the total amount stolen vary between reports. While The Korea Times and Straits Times Business cite figures around $6.3 billion, Chainalysis estimated the amount stolen at approximately $5.912 billion at the time of the theft, according to The Hindu - Sci-Tech. This incident follows a February 2025 hack of the Bybit platform, where attackers took almost US$1.5 billion.

Brief written by urgent.news from The Korea Times, The Korea Times, Straits Times Business, The Hindu - Sci-Tech, CoinDesk — 5 reports on this story. Machine-written — may contain errors; check the original before relying on it.