In brief
TRM Labs traced a $6.36 billion theft at Binance to the TraderTraitor gang, claiming the attackers moved assets across ten blockchain networks in about 20 minutes. Binance said it would cover losses from its reserves, while U.S. officials noted the case follows a pattern of North Korean hacking and asset laundering. The incident marks the biggest heist in cryptocurrency history, surpassing a $1.5 billion Bybit robbery in 2025.
In a recent cyber‑security episode that may be the biggest cryptocurrency theft recorded, a U.S. blockchain intelligence firm, TRM Labs, claims that a North Korean hacking collective known as TraderTraitor siphoned an estimated $6.36 billion in digital assets from Binance, the world’s largest crypto exchange, in a single incident that took roughly 20 minutes to complete.
TRM Labs’ analysis indicates the attackers began liaising with Binance’s systems at least 36 hours before the breach, gaining access to the transfer‑authorization layers that permit the movement of funds between wallets. By infiltrating this critical component, the hackers were able to issue permission‑granted movements of cryptocurrency without the exchange’s controls, moving holdings across ten distinct blockchain networks in the span of an instant.
During the operation, the thieves moved a total of $6.36 billion in crypto, with the audit revealing that just under two and a half billion dollars were subsequently frozen by a coalition of crypto firms and blockchain operators. However, the investigators still note that roughly $2.4 billion—chiefly Bitcoin and Ethereum—remained within the attackers’ control. TRM Labs cautions that the group may attempt to obscure the funds’ provenance by shuffling them through multiple chains and trading platforms, a tactic often used by state‑backed operatives to launder digital assets into fiat currencies.
For Binance, the theft is an unprecedented event. Co‑CEO Richard Teng took to the platform — formerly known as X — to communicate the exchange’s response. Teng assured users that Binance was operating “non‑stop” to mitigate the impact, and that the company would cover the losses through its own reserves. He added that Binance had set aside over $6.34 billion in company funds, with $5 billion already held in the token assets that had been impacted, to fully reimburse affected customers.
We are working non‑stop to resolve the issue. We are committed to covering all hacked losses through our company funds. Your assets are safe.
Teng’s statement followed a threat‑analysis note from the Federal Bureau of Investigation, which acknowledged awareness of the incident and is coordinating with domestic and international partners to understand its scope. The FBI’s involvement places the Binance theft in a larger context of state‑aligned cyber‑crime. Earlier last year, the bureau had attributed a $1.5 billion theft at the Bybit exchange in February 2025 to a group named TraderTraitor, indicating a recurrent pattern of efforts from North Korean hackers to exploit cryptocurrency exchanges.
TRM Labs’ confidence in linkage to TraderTraitor hinges on transaction‑flow similarities to prior attacks, the timing of the breach, and the level of sophistication matching known North Korean ransomware and data‑exfiltration campaigns. North Korean rhetoric and intelligence reports have consistently highlighted the regime’s reliance on a network of nationals abroad and on foreign facilitators in places like China, Russia, Cambodia, and Vietnam to move stolen digital assets into the global fiat system. U.S. officials have regularly warned that such operations fund procurement activities and weapons‑of‑mass‑destruction programs back home.
While Binance pledged to absorb the losses, the intelligence community remains concerned about the aftermath. The theft’s scale surpasses nearly all prior shenanigans in the crypto‑world, hinting at an expanded capability to move large volumes of digital wealth with minimal delay. The swift 20‑minute transfer window over ten blockchains showcases seamless inter‑chain execution—an advanced feature that not only reflects meticulous planning but also a sophisticated understanding of blockchain architecture.
The event has also prompted industry introspection into how exchanges safeguard their transfer‑authorization systems. Binance’s architecture had previously been robust enough to withstand high‑volume transactions, but the breach suggests the existence of exploitable lateral movement vectors within its authorization mesh. New security hardening measures announced by Binance include stricter multi‑factor authentication for transfer approvals and a segmented system of isolated ledger entries.
Cyber‑security analysts note that the ability to move funds across multiple blockchains simultaneously reduces the likelihood of detection by block‑chain explorers. By fragmenting a bulk withdrawal into smaller, simultaneous transfers—especially across different protocol layers—the attackers can make forensic attribution more challenging. The coordinated move across ten networks within a 20‑minute period is a testament to both the voluminous computational resources required and the attackers’ ability to manipulate permissioned blockchains alongside public ones.
The registry of trader accounts controlled by the perpetrators remains a key point of investigation. Through collaboration with exchanges reporting on suspicious wallet activity, regulators expect to flag front‑end customers receiving the funds for subsequent investigation. The initial forensic analysis points to privacy‑enhancing capabilities such as token‑stealth and mixer usage, which can further obfuscate the traceability of the stolen assets to the end‑points that were eventually frozen.
Notably, the Binance incident occurs against a backdrop of geopolitical tensions. U.S. officials have repeatedly leveraged sanctions to target North Korean hacking units, considering them a core element of the regime’s economic warfare. The scale of the theft underscores the persistent threat to global crypto ecosystems, and invites regulators to reassess risk‑management strategies for digital liquidity pools.
In the months following the breach, industry bodies such as the Blockchain Association of the United States have called for enhanced real‑time monitoring of cross‑chain transfers and the development of industry standards for swift sanctions application. Their proposal includes a real‑time alert system that banks and custodians could integrate with to flag suspicious large‑volume moves across multiple blockchains, prompting an immediate freeze or review.
As for the remainder of the stolen value, Binance’s statement suggests that losses will be absorbed from its own company funds, but an additional $268 million remains unaccounted for as of the latest public disclosure from TRM Labs. The group’s ability to move these funds between blockchains before detection has effectively carved an escape route, analogous to how traditional criminals would use a complex chain of shell companies. The continued pursuit of the remaining assets by international investigators will be crucial in mitigating the economic impact on the victims and preventing the laundering of digital wealth into the physical economy.
In sum, the North Korean assault on Binance offers a case study on the intersection of advanced blockchain operations and state‑backed cyber‑crime. With the scale surpassing all previous incidents, it compels exchanges and regulators alike to anticipate and counter sophisticated, cross‑chain attacks that threaten the integrity of the burgeoning digital asset market. The case also highlights the risk of network shadowing as a malicious tool for moving large troves of value in seamless, near‑invisibility motion between different blockchains.
