Security researchers report that hackers backed by the North Korean government drained at least $6.3 billion in digital currency from Binance company wallets, setting a record for the largest cryptocurrency heist in history while investigators froze about half of the funds across multiple blockchains.
While this incident stands as the biggest digital currency theft ever recorded, authorities have not yet confirmed a final resolution, meaning the total stolen value might still fluctuate.
Binance shared in an update on X that preliminary findings indicate the intruders breached company systems by targeting a compromised laptop belonging to an engineer, which permitted an attacker to reach a service container and execute unauthorized withdrawal requests.
The company stated that investigators found zero indications that private keys were leaked, an event that would have handed the perpetrator nearly unrestricted control over corporate digital asset reserves.
As the probe continues, the world's largest crypto exchange halted all deposits and withdrawals, following earlier reports from TechCrunch on Thursday regarding paused withdrawals across select blockchains.
Although Binance maintained that user funds are secure, the firm did not immediately supply evidence and noted that an updated proof of reserves will be published once remediation finishes.
The exact mechanics of the attack and the conditions surrounding the targeted employee laptop remain undetermined, though security breaches frequently originate from compromised software running on staff equipment.
Software typically relies on numerous elements like open-source projects that malicious actors frequently alter to extract information from infected machines, while malware disguised as ordinary applications and games can steal credentials and session tokens to mimic authorized workers.
Observers will likely question how internal security protocols allowed a single staff member computer to reach infrastructure capable of managing billions of dollars.
Representatives for Binance did not reply to inquiries seeking comment about the security breach, and TechCrunch also questioned whether the exchange underwent any third-party security audits before the incident occurred.
Blockchain intelligence and forensics specialists at TRM Labs linked the cyberattack to North Korean operatives, labeling the event the largest hack in history.
Analysts identify this hacker collective as TraderTraitor, a North Korean cell specializing in targeting major exchanges and companies for digital asset theft, having previously been blamed for the previous record of $1.4 billion stolen from Bybit in 2025.
TRM calculated that the extraction of billions from Binance took roughly 20 minutes to complete.
Another blockchain security organization, Elliptic, also connected the Binance theft to North Korean actors, noting that certain stolen assets landed in the exact wallet used during a $351 million attack on Bitget earlier in the year.
United States authorities and international partners have repeatedly highlighted the dangers posed by North Korea, a nation isolated from global financial networks due to its nuclear weapons development, with researchers stating the country targets digital currency purely to fund its sanctioned weapons programs.
