Is North Korea Behind the Massive $6 Billion Binance Hack? Insights from TRM

Major Cryptocurrency Theft Linked to North Korean Hackers

New York: A recent report from TRM, a blockchain intelligence firm based in the US, suggests that a hacking group from North Korea may be responsible for the theft of over $6 billion from Binance, the largest cryptocurrency exchange globally.

On Thursday, Binance disclosed that around $6.3 billion was affected, with its founder describing the incident as resembling a hack.

The exchange has collaborated with blockchain partners to freeze the compromised assets, successfully securing approximately $3 billion.

In light of the security breach, Binance has temporarily halted all deposits and withdrawals until thorough security assessments are conducted.

TRM's analysis points to a group known as TraderTraitor, identified as North Korea's elite hacking unit, as the likely perpetrator. The firm expressed high confidence in this assessment.

According to TRM, the attacker managed to transfer about $6.36 billion from Binance wallets across ten different blockchains, primarily executing the operation in roughly 20 minutes, marking it as potentially the largest cryptocurrency theft in history.

Previously, in February of the prior year, another exchange, Bybit, faced a $1.5 billion loss due to a hack attributed to North Korean hackers, including TraderTraitor.

TRM noted that several characteristics of this recent attack align with earlier heists linked to North Korea, including the Bybit incident.

Chainalysis, another blockchain analysis firm, also indicated that the Binance hack was likely orchestrated by the DPRK group TraderTraitor, as stated by its co-founder and CEO Jonathan Levin on social media.

When questioned about the possible connections to North Korea, a spokesperson for Binance stated that the company is actively collaborating with law enforcement to identify the criminals involved and ensure justice.

Experts suggest that North Korea has increasingly resorted to cryptocurrency hacking and other illicit cyber activities to generate much-needed foreign currency, which is essential for its struggling economy and nuclear program, especially following stringent UN sanctions.

In December 2022, South Korea's intelligence agency reported that North Korean hackers had stolen an estimated 1.5 trillion won (approximately $1.1 billion) in cryptocurrency and other digital assets over the past five years, with more than half of that amount stolen in 2022 alone. The agency noted that North Korea's capability to steal digital assets is among the most advanced globally.

Changpeng Zhao, known as CZ, founded Binance in 2017. In 2023, he pleaded guilty to a felony related to failing to prevent money laundering on the platform and subsequently stepped down as CEO. He received a pardon from US President Donald Trump in 2025.

Zhao reassured users on social media that their funds are secure, although he acknowledged that the incident appears to be a hack on Binance. He mentioned that while he no longer manages the company, he expects all user funds to be fully compensated.

In response to the hack, Binance announced that it would cover the losses incurred.

This incident has also sparked discussions regarding the lack of robust approval controls, as noted by Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab.

Gan remarked that the attack seemed to exploit a single signature that granted the hacker a permanent, unrestricted access token to a Binance hot wallet, which is a type of cryptocurrency wallet that stores users' private keys and is connected to the internet.

Binance stated on social media that it found no evidence of any leak of wallet private keys and promised to provide further technical details once its investigation concludes.