Binance reported on the social network X that the incident could be linked to a laptop belonging to a software engineer and to “other vulnerable points”, although it clarified that no evidence of direct private key leakage was found and stated: “It was a complex attack and we are doing everything possible, in coordination with law enforcement, to resolve it”.
However, Kok Tin Gan, CEO of the firm NyxLab, questioned the lack of authorization controls: “This looks like a single signature that granted the attacker a total and non-expiring access token to a hot wallet of Binance”. Additionally, professor Austin Campbell (NYU Stern) emphasized that “it is necessary to establish delays and checkpoints”, comparing the situation to automotive security: “The car can be faster, cheaper, and consume less fuel if we remove all the airbags and seatbelts”.
The largest cryptocurrency exchange in the world, Binance, which has over 300 million users and holds 135.2 billion dollars in assets (far surpassing the 28.6 billion dollars of OKX), was the victim of the theft of over 6 billion dollars —with operational estimates reaching 6.36 billion dollars—. This episode was formally classified by the blockchain intelligence firm Chainalysis as “the largest in the history of cryptocurrencies and one of the greatest financial crimes of all time”, while Aravind Srinivasan, head of the over-the-counter business at GSR, stated that “it is the largest cyber attack in history”.
The absolute focus of the investigation falls directly on the communist tyranny of North Korea, led by dictator Kim Jong Un. Major blockchain intelligence agencies —TRM Labs, Chainalysis, and Elliptic— categorically attributed the authorship of the attack to cyber networks sponsored by the Pyongyang regime. According to analysts and international experts, the regime of Kim Jong Un systematically resorts to the theft of digital assets and illicit cybercrime as a mechanism to obtain the foreign currency necessary to sustain its weakened economy and finance its threatening nuclear program, openly violating the sanctions imposed by the United Nations.
Binance
The American cybersecurity firm TRM Labs identified the TraderTraitor cell —the elite hacking unit of the North Korean regime linked to the nefarious Lazarus Group— as the executing arm of the heist and asserted: “We issue this judgment with a high degree of confidence”. It also detailed the precision of the attack: “An attacker moved approximately USD 6.36 billion from Binance wallets across ten blockchains, most of it in about 20 minutes”. For his part, Jonathan Levin, co-founder and CEO of Chainalysis, confirmed on the social network X that the attack “was likely carried out by the North Korean group TraderTraitor”.
This cyber attack does not represent an isolated incident, but rather the continuation of a criminal pattern of the North Korean state against global capitalism:
The Bybit precedent: In February of last year, the Bybit platform suffered the theft of 1.5 billion dollars, which was reliably attributed by the FBI to North Korea and the TraderTraitor unit.
The history according to South Korean intelligence: In December 2022, the intelligence agency of South Korea revealed that hackers under Kim Jong Un had stolen approximately 1.5 trillion won (equivalent to 1.1 billion dollars) in cryptocurrencies over the previous five years, concentrating more than half of that amount in the year 2022.
North Korean dictator Kim Jong Un
The funds stolen this time encompassed a combination of the main market assets: Bitcoin, Ether, USDT, and USDC.
In response to the emergency, Binance suspended capital withdrawals with the expectation of resuming them on Sunday and promised to cover the losses. Richard Teng, co-CEO of Binance, stated: “Most of our daily revenue is invested in crypto assets”, adding that “That is precisely why we can absorb a loss of this magnitude immediately, with our own money”. In the same vein, co-CEO Yi He assured that the revenues of the year 2026 will cover the amount. It was also reminded that the SAFU (Secure Asset Fund for Users) reserve fund, established in 2018 and maintained around 1 billion dollars, is still in effect.
North Korean dictator Kim Jong Un
For his part, founder Changpeng Zhao (CZ) —pardoned in 2025 by the president of the United States, Donald Trump, after pleading guilty in 2023 to failing to prevent money laundering— expressed on X that “user funds are safe”, acknowledging that “it does indeed seem like a cyber attack against Binance” and concluding: “as a shareholder, I hope that all user funds are fully covered”.
In order to contain the flow of the loot, Paolo Ardoino, CEO of Tether, froze more than 1.5 billion dollars in USDT“in connection with a possible cyber attack on the Binance exchange”; meanwhile, Jeremy Allaire, president of Circle Internet Group Inc., froze 800 million dollars of the USDC token after “reports of a possible vulnerability involving Binance”.
In the face of the threat of North Korean cyberterrorism, the FBI confirmed to Bloomberg News that it “is aware of the incident and is coordinating with its partners to understand the scope of the activity, assess the possible repercussions, and coordinate the relevant investigative measures”. The Secret Service and the Department of Justice are also involved in the investigations.
Binance
The cyber attack occurs while the administration of Donald Trump promotes blockchain technology. In September, the SEC approved the Innovation Exemption, and the CFTC presented proposals to regulate leveraged transactions and register platforms. Other recent attacks have affected Polymarket, Mirae Asset Global Investments Co., Daishin Securities, and GMO Internet Group Inc..
The financial impact shook the markets: Bitcoin fell below 77,000 dollars before rebounding to 77,200 dollars in New York. In the United States, Coinbase dropped 4.8% and MicroStrategy fell nearly 6%. An official spokesperson for Binance concluded by emphasizing that they are “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice”, exposing how the North Korean communist tyranny resorts to international crime to destabilize the Western economy.
