North Korean hackers have been blamed for what security researchers say is the largest cryptocurrency theft ever recorded, after a breach at Binance siphoned at least $6.3 billion from the world’s biggest crypto exchange. Researchers say roughly half of the stolen assets have since been frozen as the funds moved across blockchains, but the full scope of the incident is still being investigated and may change.
Binance says a compromised employee laptop was the entry point
In a post on X, Binance said its initial investigation indicates the attackers got in by targeting a “compromised” laptop belonging to a Binance engineer. The company said that access “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”
Binance said it has found no evidence that its private keys were leaked. That point matters because private keys can provide near-total control over crypto holdings, and a key compromise would suggest an even deeper failure than the one currently described.
The exchange also said it has suspended all deposits and withdrawals while the investigation continues. TechCrunch reported Thursday that withdrawals had already been paused across some blockchains before the broader suspension was announced.
What Binance says users should know
- Binance says “user funds are safe,” though it has not yet provided proof to support that claim.
- The company said it will “publish an updated proof of reserves once the remediation is complete.”
- Some $3 billion in stolen funds has already been frozen by industry partners, according to Binance spokesperson Andie Cooper.
- Binance said it has begun recovering affected assets and is working with law enforcement, issuers, blockchain intelligence firms and other industry partners.
Cooper’s statement suggests the exchange and its partners are still trying to trace the stolen assets as they move through the crypto ecosystem. In practice, that can involve trying to identify wallets, exchange deposit addresses and intermediary transactions before funds can be split, swapped or laundered further.
TRM Labs calls it the “largest hack in history”
Security researchers at TRM Labs, a blockchain intelligence and forensic company, attributed the attack to North Korean hackers and described it as the “largest hack in history.” The firm said the stolen funds were taken in about 20 minutes, highlighting how quickly a breach at a major exchange can become an enormous financial event.
TRM tied the incident to a North Korean hacker network known in the cybersecurity industry as TraderTraitor. Researchers say that group focuses heavily on stealing cryptocurrency from large companies and exchanges, making it one of the most persistent cybercrime threats facing the sector.
TRM said TraderTraitor was also blamed for the second-largest crypto theft on record, a $1.4 billion attack on exchange Bybit in 2025. If the Binance breach is confirmed at the current estimate, it would more than quadruple that previous benchmark and reset the scale of known crypto theft.
Why researchers are pointing to North Korea
The attribution is consistent with years of warnings from governments and private investigators that North Korean-linked groups are using crypto theft to fund the country’s weapons programs. The U.S. government and its allies have long warned that North Korea, which remains cut off from the U.S. and much of the global financial system, uses cyber operations to generate revenue.
Researchers say the regime’s motivation is straightforward: steal as much cryptocurrency as possible to support development of sanctioned weapons of mass destruction. That makes exchange infrastructure, hot wallets and employee accounts attractive targets because they can provide direct access to large sums that can be moved quickly.
Elliptic, another blockchain security firm, also attributed the Binance theft to North Korean hackers. The company said some of the stolen funds ended up in the same wallet used in a previous cyberattack on crypto exchange Bitget earlier this year, where hackers stole $351 million.
How a single laptop can turn into a multibillion-dollar breach
Binance has not said exactly how the engineer’s laptop was compromised, but the scenario fits a familiar pattern in security incidents. A compromised employee device can give attackers a foothold inside a company’s network, especially if the machine has access to software or services that handle sensitive transactions.
One common route is malicious or tampered software. Modern applications often rely on many third-party components, including open source libraries, and attackers sometimes compromise those dependencies to reach downstream systems. In other cases, malware hidden in legitimate-looking apps or games can steal usernames, passwords and session tokens from infected machines, letting attackers impersonate an employee.
That possibility raises the obvious question: why could one employee laptop reach systems capable of controlling billions of dollars in funds? The answer may ultimately determine whether the failure was a simple workstation compromise, a broader lapse in access controls or a more complex chain of security breakdowns.
Questions Binance may face next
- How was the engineer’s laptop compromised?
- What access did that laptop have to internal systems?
- Were multi-step approval controls in place for withdrawals of this size?
- Did Binance conduct or require an external security audit before the breach?
- How much of the stolen crypto can realistically be recovered?
Binance has not responded to emailed questions about the breach, according to the report. TechCrunch also asked the company who, if anyone, performed a security audit of Binance’s network and systems before the attack, but it was not immediately clear whether the exchange had sought such a review.
The scale of the loss could shift as the investigation continues
Although the current estimate puts the theft at $6.3 billion, the figure is not necessarily final. Crypto investigations often evolve as analysts follow wallet movements, identify additional transactions or determine whether certain funds were recovered, frozen or never fully removed from exchange control.
That uncertainty has not stopped researchers from calling the event unprecedented. Even before any formal resolution, the incident has already overtaken every known crypto theft in history and intensified scrutiny of how major exchanges protect their internal systems.
For Binance, the attack is likely to bring a new round of questions about internal access, transaction controls and incident response. For the broader industry, it is another reminder that the weakest link in a high-value crypto operation may not be a blockchain itself, but the human systems surrounding it.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: October 30, 2026 at 10:31 pm
0 views
