Blockchain analysis firms TRM and Chainalysis attributed the attack to TraderTraitor, North Korea’s elite hacking unit, with “high confidence.” TRM said an attacker moved approximately $6.36 billion out of Binance wallets on 10 blockchains, most of it in about 20 minutes. That would make it the largest cryptocurrency theft on record. The FBI previously linked North Korea to a $1.5 billion hack of Bybit in 2025.

Binance’s initial investigation suggested the breach began with a compromised laptop belonging to one of its engineers, allowing an attacker to gain access to one of its systems and make unauthorized withdrawals. However, co-founder Yi He clarified that the attack involved multiple “points of breach,” not limited to a single engineer’s permissions. Binance said it found no evidence of any wallet private key leak.

Bitcoin dropped more than 3% to a six-week low of $76,368 in early Asian trading. Tether froze nearly $1.57 billion in assets, while Circle froze over $800 million. Binance said it would publish a technical report and an updated Proof of Reserves after the investigation.

Binance was founded in 2017 by Changpeng Zhao, who pleaded guilty in 2023 to a felony related to failing to prevent money laundering on the platform and stepped down as CEO. Donald Trump pardoned Zhao in 2025. Zhao posted on X: “User funds are safe!” but added that the incident “does look like a hack on Binance.” He also said as a shareholder, he expected all user funds to be fully covered.

Tim Sun, a senior researcher at HashKey Group, said: “It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges.” Kok Tin Gan, co-founder of NyxLab, suggested the attacker may have gained access through a single signature that gave them a “never-expiring, full-access token” to a hot wallet.

Binance said it was working with law enforcement and blockchain intelligence firms to trace and recover the stolen funds. It expects to resume withdrawals within 48 hours and will publish a detailed technical post-mortem once the investigation is complete. The company also temporarily suspended Binance Alpha trading and said it would cover all losses using SAFU and company funds.