Binance says $6.3bn in crypto hit by hack; analytics firms link attack to North Korea

As reported by NPR, BBC News (Technology) and BBC News (Business). The allegations below are theirs, not Vocemundi's.

Binance, described as the world's biggest cryptocurrency exchange, said about $6.3bn of digital assets were affected by a hack. NPR describes the figure as more than $6bn. According to NPR, TRM Labs called it the largest crypto theft on record. According to the BBC, Check Point's Jayant Dave said the same.

Binance said about half of the affected assets, roughly $3bn, had been frozen with the help of partners. It said it will cover all losses. Withdrawals on the platform have been suspended. Binance said it had found no evidence of any wallet private key leak.

Binance said an initial investigation suggested a compromised laptop was involved. The BBC reports it was an engineer's laptop. The BBC quoted Binance as saying "our subsequent investigation has uncovered additional points of breach". The company said it would share further technical details once its investigation is complete.

TRM Labs attributed the attack to TraderTraitor, which it described as a North Korean hacking unit. NPR quoted TRM as saying: "We make this judgment with high confidence". Chainalysis also linked the hack to TraderTraitor. TRM said several features resemble earlier North Korea-linked incidents, including the Bybit hack. Bybit lost $1.5bn in a hack in 2025.

When asked about potential links to North Korea, Binance did not directly address them. It said it is "working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice", according to the BBC.

According to NPR, TRM said an attacker moved approximately $6.36bn out of Binance wallets on ten blockchains, most of it in about 20 minutes. NPR also reports that Binance said deposits were unaffected and that withdrawals are expected to resume in the next day or two. According to the BBC, Binance said many affected assets remained in the hands of the hackers. The BBC reports that Tether and Circle said they had frozen about $2.4bn in total. The reports do not clarify whether this is part of the roughly $3bn Binance says was frozen. According to the BBC, Bitcoin fell by more than 4% after the incident became known.

The reports reviewed by Vocemundi do not describe any attribution by a government or law enforcement agency for this hack.

What is disputed

Kok Tin Gan, CEO of cybersecurity firm NyxLab, said, according to NPR: "This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet". Binance co-CEO Richard Teng said, according to the BBC, that the attacker "did not simply use one engineer's permissions" and that "It involved a more complex attack process."

What each side says

• Binance: Teng said the compromised laptop gave access to a service container used to submit unauthorized withdrawals, according to the BBC. He said the investigation "has not attributed responsibility to any individual."
• Changpeng Zhao, Binance founder and shareholder, wrote on X, according to NPR: "User funds are safe!"
• Check Point, a cyber-security firm, said TraderTraitor is also known in the industry as Lazarus Group, according to the BBC.
• Ari Redbord of TRM Labs told the BBC the hack is a "watershed moment".
• North Korea has denied involvement in hacks in the past. The reports do not include any response from North Korea to this incident.

Vocemundi note: this story relays allegations published by NPR, BBC News (Technology) and BBC News (Business). Vocemundi did not have access to the underlying evidence or documents and has not independently verified these claims. The people and organisations named are presumed innocent; their response is included where it was available.

Analysis

The incident tests how quickly a large exchange can contain losses and restore normal operations. Two questions stand out. First, attribution so far comes from private analytics firms, not governments; any official finding could change the legal and diplomatic picture. Second, the competing accounts of how the breach happened could inform security practices across the industry, where Chainalysis' Eric Jardine urged every exchange to remain vigilant. If Binance's promised technical details support a single-credential failure, scrutiny of approval controls may grow. If they describe a more complex attack, the focus may shift to targeting of staff and systems. Recovery of funds still held by the attacker remains uncertain.

Produced by the Vocemundi newsroom with AI assistance.