North Korean Hackers Linked to Record $6.3 Billion Binance Breach

The attackers gained entry by compromising an engineer’s laptop, which provided a gateway into a service container used to authorize unauthorized withdrawals. While Binance asserts that user funds remain secure, the company has yet to provide concrete verification, promising an updated proof of reserves only after remediation concludes. Roughly half of the stolen assets have been frozen as they moved across various blockchains, according to TRM Labs.

Security analysts have identified the perpetrator as TraderTraitor, a North Korean cell specialized in targeting large-scale financial platforms. This group previously orchestrated a $1.4 billion theft from Bybit in 2025. Evidence from Elliptic further links the stolen funds to wallets used in an earlier $351 million attack on the Bitget exchange. The incident raises significant questions regarding Binance's internal security architecture, specifically how a single employee device could hold access to systems managing billions in capital.