Binance Hack Exposes $6.3B Loss

President Donald Trump declined to confirm that North Korean hackers were behind the $6.3 billion theft from Binance, the world's largest cryptocurrency exchange. The White House is waiting for a final verdict while blockchain intelligence firms already attribute the breach to a known state-sponsored group.

TRM Labs, a U.S. blockchain intelligence company, identified the attackers as TraderTraitor, a collective linked to Pyongyang. The firm stated it has a high degree of certainty in that attribution. Chainalysis, another major analytics provider, agreed with the assessment. Jonathan Levin, Chainalysis co-founder and CEO, publicly supported the hypothesis that the same group executed the raid.

According to TRM Labs, the attackers drained approximately $6.36 billion from wallets connected to Binance across 10 different blockchains. Most of the funds were withdrawn within a 20-minute window. The operation mirrors previous raids carried out by TraderTraitor, a group previously implicated in other large-scale crypto thefts.

Binance has not yet confirmed the identity of the culprits. A company spokesperson said the platform is working with authorities and partners to identify and prosecute those responsible. Richard Teng, Binance co-CEO, told followers on X that the teams are working without rest to resolve the incident.

The company reported that it has $6.34 billion in reserves to cover the stolen assets. Binance worked with other industry players to freeze roughly $3 billion of the stolen funds. Withdrawals for customers were temporarily suspended, with the company expecting to resume them within one to two days. Customer deposits remained unaffected during the outage.

Binance investigators initially traced the breach to a compromised laptop. They later identified additional vulnerabilities that expanded the scope of the investigation. Teng confirmed that a hot wallet, which is connected to the internet for transaction processing, was hit. The majority of assets remain in cold wallets, which are offline and offer greater security.

Teng noted that the attack did not appear to be the work of a single individual. The perpetrators used sophisticated techniques, including a self-destruct mechanism designed to hinder forensic analysis. The breach follows a similar attack on Bybit in February 2025, where the FBI attributed the $1.5 billion loss to North Korea and TraderTraitor.