Blockchain intelligence firm TRM Labs said on Thursday that North Korean state-sponsored hackers carried out the theft of $6.3 billion from Binance, an operation the company and rival analyst Chainalysis describe as the biggest cryptocurrency heist on record.
TRM said it reached that conclusion with "high confidence," pointing to TraderTraitor, a unit investigators have tied to the Lazarus Group. According to the firm, the raiders hit Binance wallets on 10 separate blockchains and shifted most of the money in roughly 20 minutes. Hindustan Times also reported TRM's attribution to Pyongyang.
"When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity. That makes this a global security issue, not just a crypto theft," Ari Redbord, TRM's global head of policy, told Channel NewsAsia.
Binance halted deposits and withdrawals and said it had frozen about $3 billion of the missing funds with outside partners. The exchange traced the breach to an engineer's compromised laptop, promised to make users whole and said customer deposits were untouched. Co-founder Yi He said Binance would absorb "all hacking losses."
Nothing in the record compares. The largest previous crypto theft was the $1.5 billion raid on Bybit in 2025, which the FBI also blamed on Lazarus.
Traders sold digital assets in Asian hours on Friday. Bitcoin lost more than 3 percent to touch $76,368, its weakest level in six weeks, while ether slipped past $2,178 to a two-month low, Channel NewsAsia reported. BNB, the exchange's own token, fell too.
CoinMarketCap puts Binance's assets under management at about $155 billion, the largest of any exchange. Zhao, who founded the company in China in 2017, remains its biggest shareholder. Binance said withdrawals should resume within 48 hours and that a detailed technical post-mortem would follow the investigation.
Sean Foley, a crypto markets researcher at Macquarie University in Sydney, told Al Jazeera the breach laid bare how much risk sits on centralised venues and might drive some traders to decentralised alternatives. "Any assets held at a centralised exchange are only as safe as the exchange itself, and the larger the exchange's holdings, the larger a target it becomes," Foley said.
Binance said it was working with law enforcement to identify the attackers. Pyongyang's diplomatic missions in Geneva and Beijing did not immediately respond to Reuters requests for comment, Channel NewsAsia reported.