Record USD 6.36bn Binance crypto theft linked to North Korea: TRM Labs

An attacker stole approximately USD 6.36 billion in cryptocurrency from Binance across 10 blockchains on October 29, in what blockchain intelligence firm TRM Labs described as the largest cryptocurrency theft on record.

TRM Labs attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group, based on its analysis of blockchain transactions and other intelligence.

The theft began at 20:05 UTC on Thursday, with most of the funds transferred out of Binance wallets within about 20 minutes, according to TRM Labs.

The firm said the attack was roughly four times the size of the USD 1.5 billion Bybit hack in February 2025, which the US Federal Bureau of Investigation (FBI) attributed to the same North Korean group.

TRM Labs said the operation showed similarities to earlier North Korean-linked cryptocurrency thefts, including advance preparation and transactions intended to conceal the movement of funds.

Its analysis also pointed to a possible compromise of Binance's systems used to authorize cryptocurrency transfers across different blockchains. The exchange has yet to establish the definitive cause of the breach.

How much of the stolen cryptocurrency has been frozen?

Binance said approximately USD 3 billion in affected cryptocurrency assets had been frozen with assistance from blockchain partners as it continued investigating the security breach.

TRM Labs had earlier reported that Tether, Circle, Ripple and World Liberty Financial had collectively frozen approximately USD 2.67 billion in stablecoins as of 00:30 UTC on October 30.

Arbitrum's Security Council also used emergency powers to move approximately USD 30 million in affected assets beyond the attacker's control, bringing the total to roughly USD 2.7 billion.

The firm said the attacker still controlled about USD 2.4 billion in cryptocurrency beyond the ability of token issuers to freeze, including substantial holdings of Bitcoin and Ether.

Unlike centralized stablecoins such as USDT and USDC, whose issuers can freeze tokens, Bitcoin and Ether cannot be directly frozen by a central token issuer, making recovery more difficult. The stolen funds can still be traced, and authorities or exchanges may be able to intervene if the assets pass through cooperating services.

Binance estimated the incident's total financial impact at approximately USD 6.3 billion.

The breach also unsettled cryptocurrency markets. Bitcoin fell below USD 77,000, according to The Block, while Reuters reported declines in Ether and Binance's BNB token.

The exchange said its preliminary investigation suggested that a compromised laptop belonging to a DevOps engineer may have allowed an attacker to access an internal system and submit unauthorized withdrawal transactions.

Binance said it had found no evidence that cryptocurrency wallet private keys had been leaked.

The exchange temporarily suspended deposits and withdrawals as a precaution while conducting security checks, revoking an affected address authorization and working with law enforcement and blockchain investigators to trace the funds.

Binance said customer funds remained safe and pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and company funds.

TRM Labs said it was continuing to track the stolen cryptocurrency through its Beacon Network, which helps coordinate efforts to identify and intercept illicit funds.

The investigation remains ongoing, and Binance said it would publish a detailed technical report once the circumstances of the breach have been established.