Binance suffers ‘largest cryptocurrency theft ever’ as North Korean hackers steal $6.3 billion in just 20 minutes
follow us
Add us as a preferred source on Google
- Attackers Allegedly Stole $6.36 Billion From Binance in Record Crypto Exchange Breach
- Investigators linked the attack to North Korea’s Lazarus Group, taking advantage of the access of a compromised engineer.
- Binance said customer funds remain safe, while authorities and partners froze billions in stolen assets
Cybercriminals, allegedly from an infamous North Korean hacking organization, gained access to one of the largest cryptocurrency exchanges on the planet, Binance, and in less than half an hour withdrew $6.36 billion in different tokens.
Security researchers TRM Labs said the attack was carried out by a group called TraderTraitor, which it describes as “North Korea’s main hacking unit.”
“We based this assessment on strong on- and off-chain intelligence sources,” TRM Labs said in a report, noting that TraderTraitor is part of Lazarus Group, the North Korean state-sponsored threat actor blamed for some of the largest cryptocurrency thefts in history, and is blamed by the FBI for the $1.5 billion Bybit hack that took place on February 21, 2025.
Latest videos ofTechnologyRadar
Gone in 20 minutes
Binance experts, as well as independent investigators, are still piecing together what happened, so information could change over the days. What we know so far is that a DevOps engineer had his laptop compromised, which was confirmed by Richard Teng, co-CEO of Binance, in a LinkedIn post.
“That gave the attacker access to a service container, where he performed unauthorized withdrawal transactions,” he said.
At this point, no one really knows what exactly happened and what it means that a DevOps engineer’s laptop was compromised. However, we do know that Lazarus is famous for running operations DreamJob and Contagious Interview, where they create fake companies and jobs and then approach software engineers working on crypto projects. They lure them with lucrative job offers and exciting opportunities, and hide malware during multiple rounds of interviews.
But Binance’s security measures are stronger than that, and simply installing malware on a device would not have been enough. Teng also confirmed that, saying that “the attacker did not simply use an engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process.”
The funds are SAFU
TRM Labs said the attackers withdrew funds from 10 different chains, including Bitcoin, Ethereum, XRP, Tron, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. The Ethereum chain was the hardest hit, losing approximately $3.79 billion. It could be due to the chain’s smart contract feature, which allowed attackers to continue withdrawing funds as they entered the wallet.
Binance is one of the largest and most popular cryptocurrency exchanges on planet Earth and as such holds billions of dollars in user funds. However, this attack was not aimed at user funds, but at Binance itself. This was confirmed by both Teng and TRM Labs, with the co-CEO saying “your funds are safe” and “Binance will cover all losses from the SAFU fund and company funds.”
In response to the attack, Binance temporarily restricted deposits and withdrawals. Numerous users took to X this morning to say that their transaction requests were rejected. The police and other relevant entities were notified and apparently around $3 billion was already frozen on the chain.
Tether, Circle, Ripple, and World Liberty Financial froze around $2.67 billion in stablecoins, TRM Labs confirmed, while the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of about $2.7 billion.
What is particularly interesting about this incident is how the market responded. In 2013, when Mt.Gox (at the time the world’s largest cryptocurrency exchange) was hacked for $450 million, it was considered a “black swan” event, causing Bitcoin to fall by more than a third (35%) in a few weeks. The 2025 Bybit hack caused BTC to drop by approximately 7.5%. In response to the Binance hack, BTC fell a measly 6.7%, which is just another Friday in the cryptocurrency world.
Incoming phishing
Problems always come in pairs, and this Binance hack will likely be no exception. NordVPN security researchers are warning users that other hacking groups could try to take advantage of the news to send phishing emails to users.
“Another risk is that criminals will take advantage of the confusion and fear among cryptocurrency owners on other platforms. An email claiming your funds are at risk, a fake support account offering help, or a message urging you to move your cryptocurrency to a ‘secure wallet’ could be an attempt to steal from you,” said Marijus Briedis, CTO of NordVPN.
“Check for updates through the Binance app or a website address you already trust. Avoid links in unsolicited messages and never give anyone your password, verification codes, or wallet recovery phrase. The pressure to act immediately should be a reason to pause and verify the request.”
“These steps can reduce the risk of someone taking over your account, but they can’t prevent a breach of the platform itself. Cryptocurrency companies typically have strong cybersecurity as they are digital companies, so if one can be involved in the biggest hack in history, it shows how lucrative a single flaw can be.”
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment