Binance Hack: $6.36 Billion Theft Points to North Korea

Roughly $6.36 billion disappeared from Binance wallets overnight in what would be the largest cryptocurrency theft on record. Security researchers are pointing toward North Korea, although no official confirmation has been issued.

The total impact is estimated at close to $6.3 billion and could have been higher. About half of the funds were frozen: Tether blocked around $1.6 billion, and Circle froze more than $800 million in USDC. The figure is roughly four times the previous record, the 2025 Bybit heist, in which about $1.5 billion was stolen.

Signs pointing to Pyongyang

Blockchain analytics firm TRM Labs says it has "high confidence" that TraderTraitor, a group linked to the Lazarus network, carried out the attack. According to TRM Labs, several characteristics of the incident match earlier thefts tied to North Korea. Investigators have also linked it to Bybit because some addresses used in the new attack were already used in 2025. The FBI has not commented officially, so the attribution remains preliminary.

The Bybit precedent is telling. In February 2025 the FBI attributed that theft to North Korea within days, and the thieves spread part of the loot across thousands of addresses on several blockchains to launder it. Chainalysis estimated that regime-linked hackers stole about $2.02 billion in crypto in 2025 alone, 51% more than a year earlier and a record, bringing their cumulative total to $6.75 billion.

Advanced tools and a clear purpose

Kaspersky documented Operation FlashHole, active since at least July 2025 and aimed at South Korean software, construction and telecom firms. Attackers used a fake résumé with a likely AI-generated photo as phishing bait. The novelty was a Lazarus tool that protects downloads of further malware with ML-KEM-1024, a post-quantum algorithm. Kaspersky researcher Sojun Ryu said it shows a very high level of expertise.

US Director of National Intelligence Tulsi Gabbard told Congress that such thefts help fund Kim Jong-un's regime and its strategic weapons program. A 2024 UN report estimated crypto theft could supply up to half of the country's foreign currency.

North Korea also earns hard currency more quietly through remote work. IT workers use stolen identities to get jobs and operate company laptops hosted in accomplices' homes in the US. The Justice Department detailed a scheme affecting more than 70 companies that generated about $3 million, and in Texas the FBI searched more than 40 homes and seized about 187 devices.