A North Korean hacking group is likely behind the staggering $6.3 billion hack of Binance, now the largest cryptocurrency heist in history, according to investigators.
Two blockchain-tracking firms, Chainalysis and TRM Labs, point the finger at the North Korean state-sponsored group TraderTraitor, also known as Lazarus, which has targeted cryptocurrencies. TraderTraitor was blamed for last year’s $1.5 billion hack on the Bybit exchange, then the record holder for the largest crypto heist. Last month, the group was also blamed for another $387 million heist on the Bitget exchange.
Chainalysis has spotted funds stolen from the Binance hack being transferred out and “commingling” with accounts used to steal funds from last month’s Bitget heist. TRM Labs also pins the Binance hack on TraderTraitor with “high confidence,” citing “robust onchain and offchain intelligence.”
(Credit: Chainalysis)
TRM Labs suspects the North Korean hackers were able to deploy malicious code on Binance’s internal cryptocurrency wallet, enabling swift transfers within minutes. Specifically, the attackers targeted a “hot wallet” used to process customer withdrawals. In addition, they exploited a May 2025 upgrade to the Ethereum blockchain, EIP-7702, to automate fund transfers.
At 4:20 p.m. EST on Thursday, the hackers “submitted a single transaction containing 50 authorizations. Each was signed by the Binance hot wallet, and each pointed it to a sweeper contract that accepts instructions only from the operator,” TRM Labs says. “Three minutes and 24 seconds after the delegation, the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.”
TRM Labs also suspects “the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains,” paving the way for the North Korean group to loot other cryptocurrencies from Binance. Chainalysis adds that “the unauthorized transfers totaled approximately $6.4 billion USD.”
The group then focused on quickly laundering the funds. “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds,” Chainalysis notes. However, Binance and other crypto firms quickly froze some of the funds when possible.
(Credit: btgbtg via Getty Images)
This morning, Binance said it has frozen $3 billion and is recovering assets. The exchange also reassures customers that their losses will be covered. “Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted,” the company tweeted.
Recommended by Our Editors
Still, that leaves about $3 billion the North Koreans might claim. However, Binance says it’s working with law enforcement and cryptocurrency issuers to seize the remaining funds.
Binance initially said the hack may have occurred through a compromised employee’s laptop. But it now says: “Subsequent investigation has uncovered additional points of breach.”
“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them,” the company adds.
About Our Expert
Michael Kan
Principal Reporter
Experience
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
Leave a Reply