North Korean hackers blamed for reported $6.3 billion Binance breach as crypto industry moves to freeze assets
North Korean state-sponsored hacking group TraderTraitor has been blamed for a reported US$6.3 billion cryptocurrency breach involving Binance, with blockchain intelligence specialists identifying similarities to previous attacks attributed to the group.
US blockchain intelligence firm TRM Labs has attributed the attack to TraderTraitor, describing the incident as a state-sponsored operation based on its analysis of cryptocurrency transactions and other intelligence.
“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence,” the firm announced on Friday afternoon (AEDT).
According to TRM Labs, billions of dollars in cryptocurrency assets were moved from Binance wallets across ten blockchain networks in approximately 20 minutes. The firm identified several characteristics consistent with previous North Korean-linked cryptocurrency thefts, including preparations made well before the breach and transaction authorisations obtained in advance.
Binance has not publicly identified those responsible for the incident. However, the cryptocurrency exchange has confirmed that over US$3 billion in assets has been frozen, with further recovery efforts underway.
The company has reassured customers that it will cover all losses through its emergency Secure Asset Fund for Users (SAFU) and corporate funds.
Binance Co-Founder Yi He said withdrawals were expected to gradually resume within 48 hours, while deposits continued to operate normally.
“We are working non-stop to resolve this issue. Binance will cover all losses,” the company said.
The incident has triggered a coordinated response across the cryptocurrency industry, with exchanges, stablecoin issuers and blockchain networks racing to freeze assets before they can be moved through the broader digital asset ecosystem.
Tether CEO Paolo Ardoino confirmed that the company had frozen more than US$1.5 billion worth of assets linked to the potential Binance breach.
“Protecting the industry and our partners is our main priority,” Ardoino said.
Arbitrum’s Security Council has also intervened, freezing approximately US$30.5 million in assets linked to the attacker.
The disruption has extended to cryptocurrency lending platform Aave, whose risk management team announced it had frozen new deposits and borrowing activity across 292 token reserves.
Aave’s risk team said the attacker’s existing loan position did not pose a threat to suppliers on the platform.
“Markets will stay frozen until the exploiter’s funds stop moving and we get more clarity on the containment from Binance’s side,” LlamaRisk said.
The reported breach has also placed pressure on cryptocurrency markets, with major digital assets declining in the hours following the incident.
In the immediate aftermath, Bitcoin fell approximately 5%, dropping below US$77,000, while Binance-linked token BNB declined around 8%, and Ethereum fell approximately 5%.
Despite the market reaction, Wintermute CEO Evgeny Gaevoy suggested Binance had sufficient financial resources to absorb the losses.
“Binance has enough to withstand 3-4x of current hit and still be largely intact,” Gaevoy said.
Wintermute disclosed that its exposure to Binance represented less than 20 per cent of its net equity. Rival trading firm GSR reported exposure below 5% and said it did not anticipate any material disruption.
The incident highlights the growing importance of cross-industry cooperation in responding to major cryptocurrency security breaches, as digital asset companies work to contain losses, freeze stolen funds and restore confidence across the market.
