North Korean hackers have been blamed for stealing more than $6.3 billion (£4.7 billion) from cryptocurrency exchange Binance in what investigators describe as the largest digital asset theft in history.
Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, an elite North Korean hacking unit, and said most of the funds were transferred within approximately 20 minutes on Thursday evening.
The theft surpasses the $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025, an attack which the FBI attributed to North Korea.
The incident has renewed concerns over Pyongyang’s use of state-sponsored cybercrime to finance its nuclear weapons and ballistic missile programmes despite international sanctions.
TRM Labs based its attribution on blockchain transactions and other intelligence.
According to the firm, the attackers transferred approximately $6.36 billion across ten blockchain networks, including Bitcoin, Ethereum, Tron and Solana.
The operation began at approximately 20:05 UTC on October 29, with investigators identifying evidence that preparations had started at least 36 hours earlier.
TRM Labs said the operation involved valid transaction signatures across multiple blockchain networks, suggesting the attackers had compromised part of Binance’s transaction-authorisation infrastructure.
The firm stated: “In TRM’s assessment, the most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains.”
Ari Redbord, chief policy officer at TRM Labs, told Sky News: “This is an extraordinary hack, for its size and for the response… Few financial systems have ever shown a theft of this scale.”
He added: “The theft shows how exposed the system is to sophisticated attackers moving at a speed we have never seen.”
Binance said its initial investigation suggested the attackers may have gained access through a compromised laptop belonging to a DevOps engineer.
The company subsequently reported discovering additional possible points of compromise as its investigation continued.
Richard Teng, the company’s co-chief executive, said in a post on X: “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process.”
He added: “Our investigation has not attributed responsibility to any individual.
“Our team hasn’t stopped. We’re working closely with law enforcement to ensure the matter is handled appropriately.”
A Binance spokesman said: “Binance’s initial investigation suggests that the security incident may involve a compromised dev-ops engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
“We have found no evidence of any wallet private key leak.”
The exchange suspended deposits and withdrawals while its security teams investigated the breach.
Binance insisted customer funds remained safe and said it would cover losses from company reserves and its emergency protection fund.
Co-founder Yi He said the exchange would “cover all hacking losses”.
Cryptocurrency companies including Tether, Circle, Ripple and World Liberty Financial subsequently froze billions of dollars in digital assets linked to the attack.
TRM Labs reported that approximately $2.7 billion had been frozen by early Friday, while Binance said around $3 billion had been frozen as recovery efforts continued.
However, substantial quantities of Bitcoin and Ether remained beyond the reach of companies able to block transactions involving centrally issued tokens.
TRM Labs said the attacker still controlled more than 420,000 Ether and 18,270 Bitcoin, worth approximately $2.4 billion.
Investigators reported that stolen funds had been transferred between cryptocurrencies and through lending platforms, complicating attempts to trace and recover the proceeds.
US authorities have previously warned that North Korea uses stolen digital assets to circumvent sanctions and generate revenue for its weapons programmes.
Reuters reported that the FBI and US Secret Service were working with Binance following the attack, citing a person familiar with the matter.
Bitcoin fell towards $77,000 following news of the breach, while other cryptocurrencies also recorded sharp declines.
In Britain, the Financial Conduct Authority (FCA) confirmed it was engaging with Binance to assess the impact of the incident.
The regulator said Binance was not registered to provide cryptocurrency services in the UK and that it was seeking to understand the impact of the reported security breach.
The National Crime Agency declined to comment.
