U.S.-based blockchain intelligence firm TRM said a North Korea hacking unit was likely behind the theft of more than $6 billion on the world’s biggest cryptocurrency exchange, Binance.
asserted
unit → say → exchange
Binance said late on Thursday that approximately $6.3 billion was impacted, which its founder described as “like a hack.”
The company said it worked with blockchain partners to freeze affected assets, and roughly $3 billion was frozen.
The cryptocurrency exchange added that it had temporarily suspended deposits and withdrawals while security checks are completed.
asserted
checks → say → deposits
TRM, in a post on its website Thursday, attributed the attack to TraderTraitor, which it described as North Korea’s elite hacking unit.
asserted
it → attribute → unit
“We make this judgment with high confidence,” the firm said.
asserted
firm → make → confidence
“An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes,” TRM said.
asserted
TRM → move → minutes
That would make the hack the largest cryptocurrency theft on record, it said.
asserted
it → make → record
In February last year, another cryptocurrency exchange Bybit suffered a $1.5 billion hit when it was hacked.
asserted
it → suffer → hit
The FBI said North Korea and TraderTraitor were responsible for the hack.
asserted
Korea → say → hack
“Several features of this attack match earlier North Korea-linked heists, including the Bybit hack,” TRM said.
asserted
TRM → match → hack
Blockchain analysis company Chainalysis also believed the Binance hack was “likely done by DPRK group TraderTraitor,” its co-founder and CEO Jonathan Levin wrote on X.
asserted
Levin → believe → TraderTraitor
DPRK stands for the Democratic People’s Republic of Korea, North Korea’s official name.
asserted
DPRK → stand → Korea
Asked about the potential ties to North Korea, a Binance spokesperson said only that the company is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.”
asserted
company → ask → justice
Experts say North Korea has turned to crypto hacking and other illicit cyber activities as a source of badly needed foreign currency to support its troubled economy and fund its nuclear program in the wake of tough U.N. sanctions and other difficulties.
asserted
Korea → say → sanctions
In December 2022, South Korea’s spy agency said North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in cryptocurrency and other virtual assets in the past five years, more than half of it in 2022 alone.
asserted
hackers → say → 2022
It said North Korea’s capacity to steal digital assets was considered among the best in the world.
asserted
capacity → say → world
Changpeng Zhao, also known as CZ, founded Binance in 2017.
asserted
Zhao → know → 2017
In 2023, he pleaded guilty to a felony linked to failing to prevent money laundering on the platform, and stepped down as the company’s CEO.
asserted
he → plead → CEO
U.S. President Donald Trump pardoned Zhao in 2025.
asserted
Trump → pardon → 2025
Zhao posted Thursday on X that “User funds are safe!” but added that the theft “does look like a hack on Binance.”
asserted
theft → post → Binance
He added that while he doesn’t manage Binance anymore, “as a shareholder, I expect all user funds will be fully covered.”
asserted
funds → add → shareholder
On Thursday, Binance said it would cover the losses from the apparent hack.
asserted
it → say → hack
The event, meanwhile, also raises questions on why stronger approval controls were not in place, said Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab.
asserted
Gan → raise → NyxLab
“This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,” he said, referring to cryptocurrency wallets that hold users’ “private keys,” or unique authorizations, digitally and which are connected to the internet.
asserted
which → look → internet
Binance said on X it had “found no evidence of any wallet private key leak” and that the company would release more technical details when its probe is complete.
asserted
probe → say → details
The Aporia
