Binance says hackers stole $6.34 billion in largest crypto heist on record

Binance, the largest cryptocurrency exchange in the world, confirmed Friday that attackers stole more than $6 billion in digital assets, marking what appears to be the single largest theft in the history of the industry. The company stated it has reserved $6.34 billion in company funds to cover the stolen value and has begun the process of recovering assets for its users.

Blockchain intelligence firm TRM attributed the attack to a North Korean hacking group known as TraderTraitor. TRM said the attacker moved approximately $6.36 billion out of Binance wallets across ten different blockchains, with the majority of the transfer occurring in about 20 minutes. The firm noted that several features of the attack matched earlier heists linked to North Korea. Chainalysis, another blockchain analysis company, also attributed the hack to TraderTraitor in a post by co-founder and CEO Jonathan Levin.

President Donald Trump told reporters at the White House on Friday that U.S. officials are investigating the incident. When asked if North Korea was involved, Trump said, “We’re looking at that.” A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals.

Binance co-CEO Richard Teng said in a video posted to X that the company is working nonstop to resolve the issue. He confirmed that one of the exchange's hot wallets, which hold private keys connected to the internet, was affected. Teng explained that the vast majority of user assets sit in offline cold wallets and are only moved to hot wallets for withdrawals. He said deposits were not affected, but withdrawals are suspended and are expected to resume within a day or two.

The initial investigation suggested a compromised laptop was involved, but subsequent reviews uncovered additional points of breach. Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, said the attack appears to have used a single signature that gave the attacker a never-expiring, full-access token to the hot wallet. Teng said the attackers used complex tactics, including a self-destruct mechanism that complicates the investigation.

Independent analyst Garrick Hileman noted that while roughly $3 billion in affected assets were frozen, hackers are already transferring and converting the remaining stolen funds. He compared the process to money laundering, where stolen goods are mixed with other cryptocurrencies through a mixer to make tracking harder. TRM and other experts said this event represents the largest cryptocurrency theft on record, surpassing the $1.5 billion hack of Bybit in February 2025.

Binance founder Changpeng Zhao wrote on X that while this hack is the largest by dollar value, previous attacks on companies like Mt. Gox affected a larger amount of bitcoin. Experts warn that cyber attacks of this scale may become more common as threats grow more sophisticated. Andy Ward, a senior vice president at Absolute Security, said, “A cyber attack of this level is a matter of when, not if, particularly alongside the rise of AI.”