North Korean Hackers Pull Off $6.3B Binance Crypto Heist

In a security alert published Saturday, the FBI attributed the October 29 attack to a group it calls TraderTraitor, a North Korean hacking group better known to many as Lazarus Group. Blockchain intelligence firms TRM Labs and Chainalysis had already tied the theft to the same group. The haul dwarfs the roughly $1.46 billion stolen from rival exchange Bybit in February 2025, which was also pinned on North Korea.

According to Binance, it all started with one laptop. The exchange said their initial investigation points to a compromised device belonging to one of their DevOps engineers. The attacker used it to reach a service container inside Binance's systems and submit unauthorized withdrawal transactions. Binance later said investigators found additional points of entry beyond the laptop, but they haven't shared details or explained how the laptop itself was compromised. TraderTraitor is known for using fake job recruitment offers to trick targets into running malicious code.

Binance paused deposits and withdrawals while they ran security checks, though deposits returned to normal quickly. The exchange pledged to cover all losses through their Secure Asset Fund for Users (SAFU) and company funds, and has since set aside more than $6.34 billion from their own capital to reimburse affected users. On Tuesday, Binance said they would keep gradually reopening withdrawals for more assets across more networks.

The wider crypto industry moved fast to limit the damage. Tether froze nearly $1.57 billion in USDT and Circle froze more than $800 million in USDC, and roughly $3 billion had been frozen with partners by the morning of October 30.

The FBI said the hackers are converting stolen assets mainly into Ether and expects them to launder the funds further through decentralized finance platforms and instant swap services. The agency is urging exchanges, node operators and other crypto services to block transactions tied to addresses linked to the theft. Chainalysis told CNBC that North Korea-linked actors have started moving funds onto Solana after draining $500 million from Tron staging wallets.

North Korea has rejected the accusation. Kim Yo Jong, sister of leader Kim Jong Un, called the FBI's attribution a grave political provocation and accused Washington of blaming Pyongyang for cybercrimes around the world, according to state media.

The biggest takeaway for everyday users may be how the attack began. A single compromised work computer opened the door to billions in losses at one of the world's best-defended exchanges. Keeping your own devices protected is a simple way to avoid becoming someone's entry point.

Get an Antivirus to Keep Hackers Off Your Devices

For more articles like this, check out our Tech News page!