Binance Hack: North Korea Blamed for Record $6.3 Billion Crypto Heist

A cryptocurrency hack of unprecedented scale is rapidly becoming something larger than a cybersecurity story.

Approximately $6.3 billion in digital assets were affected in an attack on Binance, the world's largest cryptocurrency exchange, according to the company. Blockchain intelligence firms have attributed the operation to hackers associated with North Korea.

If that attribution is confirmed, the incident represents an extraordinary intersection between cryptocurrency and geopolitics: a heavily sanctioned state potentially acquiring billions of dollars through an operation conducted almost entirely in cyberspace.

Binance says approximately $3 billion of the affected assets have already been frozen and that customers will not bear the losses.

But billions remain at the center of an international hunt.

The Largest Crypto Heist Ever Recorded

The scale is difficult to overstate.

TRM Labs estimates approximately $6.36 billion was moved from Binance wallets across multiple blockchains, with most of the operation taking place during a period of only about 20 minutes on October 29.

For comparison, hackers stole approximately $1.5 billion from cryptocurrency exchange Bybit in February 2025.

That attack was itself considered extraordinary.

The Binance theft is roughly four times larger.

Cryptocurrency prices reacted quickly. Bitcoin fell below $77,000 during the initial market reaction, while Ether, BNB and other major cryptocurrencies also declined.

Why North Korea Is Being Blamed

Blockchain intelligence firm TRM Labs says it attributes the Binance operation to TraderTraitor, described as an elite North Korean hacking unit.

The firm says its assessment is made with high confidence and is based on a combination of blockchain and other intelligence.

TRM also identified similarities with previous attacks attributed to North Korean hackers, including the Bybit theft.

The attribution is significant because North Korea has repeatedly been accused of using cryptocurrency theft to circumvent the financial isolation created by international sanctions.

The FBI previously attributed the $1.5 billion Bybit theft to North Korean actors.

The Binance attack would move the scale of those operations into an entirely different category.

Cybercrime as a Tool of State Power

Traditionally, governments acquire foreign currency through exports, taxation, borrowing or access to international financial markets.

Sanctioned governments have fewer options.

Cyber operations introduce another possibility.

A sufficiently sophisticated hacking organization can potentially penetrate financial infrastructure in another country, steal digital assets and attempt to convert those assets into usable currency.

That makes cryptocurrency theft fundamentally different when it is conducted by a state-backed organization.

It is no longer simply organized crime.

It can become an instrument of national finance.

A successful multibillion-dollar operation could potentially generate resources comparable to major exports or international financing packages—without ships crossing borders, banks approving transfers or customs authorities inspecting cargo.

But Stealing Crypto Is Not the Same as Spending It

The response to the Binance attack also demonstrates why cryptocurrency theft has become more complicated.

Within hours, companies across the crypto ecosystem began freezing assets associated with the attacker.

Tether froze more than $1.5 billion in USDT, while Circle froze more than $800 million in USDC, according to statements reported following the incident. Other organizations intervened as well.

Approximately $3 billion had been frozen by October 30, Binance said.

Bitcoin and Ether are harder to freeze because there is no central issuer capable of simply disabling them.

Stablecoins are different.

Their issuers can blacklist addresses, effectively preventing particular tokens from being transferred.

The attack therefore became a race.

The hackers needed to move or exchange assets before companies could identify and freeze them.

Investigators and cryptocurrency companies needed to respond faster.

A New Kind of Financial Battlefield

The Binance incident illustrates how dramatically the architecture of international finance has changed.

In conventional banking, moving billions of dollars typically requires institutions operating within national regulatory systems.

Cryptocurrency allows enormous quantities of value to move between addresses across borders in minutes.

That creates opportunities for legitimate commerce.

It also creates opportunities for governments, criminal organizations and sanctioned entities.

At the same time, the response to the Binance hack demonstrates that cryptocurrency is not necessarily the ungovernable financial system its earliest advocates imagined.

Stablecoin companies froze assets.

Blockchain analysts followed transactions.

Binance contacted law enforcement.

Addresses associated with the attack became visible to investigators around the world.

The blockchain can facilitate theft at extraordinary speed while simultaneously leaving a public record of where many of the stolen assets travel.

Binance Says Customers Will Be Protected

Binance has promised that customers will not absorb the losses.

The exchange says it will use its SAFU emergency reserve and company funds to cover losses and plans to publish an updated proof of reserves once remediation is completed.

Its initial investigation pointed to a compromised DevOps engineer's laptop that allegedly allowed an attacker to access internal infrastructure and submit unauthorized withdrawals.

Binance subsequently said investigators had identified additional breach points and that the attack was more complex than initially understood. The company says it has found no evidence that wallet private keys were leaked.

A full technical investigation is still underway.

More Than a Binance Story

The immediate story is about Binance.

The larger story concerns the changing nature of economic security.

Sanctions were designed for a world in which governments, banks and regulated financial institutions controlled most international movement of money.

Cryptocurrency created another financial layer.

North Korea's alleged cyber operations demonstrate how states under severe financial restrictions may attempt to exploit that layer.

And the sheer scale of the Binance attack shows how consequential that strategy can become.

If investigators' attribution is ultimately confirmed, October 29 will not simply be remembered as the day of the largest cryptocurrency hack in history.

It will be another indication that the distinction between cybercrime, national security and international finance is disappearing.