The cryptocurrency exchange Binance has reported a massive security breach resulting in the theft of over $6.3 billion in digital assets. Blockchain intelligence firms, including TRM Labs and Chainalysis, have identified North Korea’s elite hacking unit, known as TraderTraitor, as the primary suspect. The breach is being described as the largest cryptocurrency theft on record, significantly exceeding previous high-profile incidents such as the $1.5 billion Bybit hack of 2025. According to TRM Labs, the attackers moved the majority of the funds across ten different blockchains in a window of approximately 20 minutes.
The image provides visual context for the Binance exchange mentioned in the report of the record-breaking theft.
Binance co-CEO Richard Teng indicated that the initial point of entry was likely a compromised laptop belonging to a DevOps engineer. This access allowed the attackers to reach a service container and submit unauthorized withdrawal transactions. While the company has worked with partners to freeze approximately $3 billion of the stolen assets, the remaining $3.3 billion remains at risk. Binance has stated it will cover all hacking losses using its SAFU fund and company reserves, and it has temporarily suspended withdrawals on several networks while it conducts a security revamp of its withdrawal services.
Technical experts have noted that the scale of the theft highlights significant vulnerabilities in how centralized exchanges manage privileged access. The fact that a single compromised device could authorize billions in transfers raises questions about the internal controls governing 'hot wallets'—digital assets held in accounts that are connected to the internet for immediate use. Furthermore, the attackers are reportedly attempting to convert stolen stablecoins into Ethereum (ETH) to evade freezing, as ETH lacks a centralized issuer and cannot be blacklisted by providers like Tether or Circle. While blockchain transactions are traceable, the rapid movement of funds across multiple wallets and chains complicates recovery efforts.