Hackers stole more than $6 billion in cryptocurrency from Binance on Thursday, shattering the record for the largest such heist. Security researchers and blockchain analysis firms quickly pointed to North Korea’s state-sanctioned Lazarus Group, Coindesk reported. A team of cryptocurrency firms managed to freeze about $3 billion of the stolen loot by Thursday night during a frenetic battle to control the digital money.
Hackers Target Binance DevOps Engineer Laptop
The attackers breached digital wallets held at Binance by targeting a DevOps engineer’s laptop. Binance stated late Thursday that the initial investigation indicates the hack compromised an engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.
In response to the breach, the exchange temporarily suspended deposits and withdrawals while completing security checks. Binance also revoked the affected address authorization and engaged law enforcement and blockchain intelligence partners to trace and recover the funds.
The exchange assured users that their funds remain safe. Binance promised to cover all losses using the company’s funds and an emergency assets fund.
Blockchain Sleuths Track North Korea Connection
Investigators rapidly connected the infrastructure of the attack to known state-sponsored actors from Pyongyang. Blockchain investigator ZachXBT stated in a post on X that the attacker was likely Lazarus. TRM Labs published a blog post late Thursday attributing the heist to an elite North Korean hacking unit, citing robust on- and off-chain intelligence and expressing high confidence that the TraderTraitor subunit carried out the exploit.
Jony Levin, the CEO of Chainalysis, confirmed that the analytics firm assessed the hack as likely executed by the DPRK group TraderTraitor, noting links to a previous hack. Pangolin Intelligence, a Singapore-based tracking firm, similarly attributed the breach to a North Korean cyber unit following on-chain correlation analysis.
Unprecedented Scale Exceeds Prior Heists
The staggering $6 billion loss dwarfs previous major cryptocurrency exploits. The Lazarus Group was previously linked to the February 2025 attack on Dubai-based exchange Bybit, which stole $1.46 billion and stood as the largest hack in history until Thursday’s incident. The Lazarus Group is also believed to be responsible for other large crypto attacks, including the $292 million exploit of KelpDAO in April, and the $625 million hack of the Ronin Network in 2022.
Industry executives expressed shock at the sheer volume of assets compromised in a single strike. It’s the biggest hack in history,
Aravind Srinivasan, head of large crypto market maker GSR’s systematic OTC business, told Reuters. Analysts note that North Korea relies heavily on such state-sponsored cyberattacks to generate vital revenue for its nuclear-armed regime in the face of international sanctions.
Questions Remain Amid Investigation
While investigators point to Pyongyang, a definitive attribution remains unconfirmed by law enforcement agencies. Chainalysis reported monitoring stolen funds moving across multiple blockchains, including Bitcoin and Ethereum. US law enforcement and agencies including the FBI and the Secret Service face mounting pressure to trace the remaining un-frozen assets before laundering networks convert them into fiat currency.
Frequently Asked Questions About the Binance Breach
How much of the stolen cryptocurrency was recovered?
Cryptocurrency firms successfully froze approximately $3 billion of the stolen digital assets by Thursday night through a coordinated emergency response with blockchain intelligence partners.
Which specific unit is suspected of carrying out the attack?
Blockchain firms including TRM Labs and Chainalysis identified TraderTraitor, a specialized subunit of North Korea’s state-backed Lazarus Group, as the primary suspect behind the exploit.
What immediate steps did Binance take following the security breach?
Binance suspended all deposits and withdrawals, revoked compromised address authorizations, and pledged to cover all user losses entirely out of company reserves and emergency funds.
Worth a look