Roughly $6.3 billion vanished from Binance's crypto wallets this week in what blockchain analytics firms are calling the largest cryptocurrency theft on record — and multiple investigators say the attack bears the signature of North Korea's state-sponsored hacking operation.

TRM Labs said about $6.36 billion moved out of Binance wallets across ten different blockchains, with most of the funds leaving in roughly 20 minutes. The firm attributed the attack "with high confidence" to TraderTraitor, the North Korean hacking unit the FBI has already tied to last year's $1.5 billion theft from the crypto exchange Bybit. Chainalysis independently pointed to North Korean involvement as well, estimating the total closer to $6.4 billion, according to Decrypt.

Weeks of preparation, minutes to execute

TRM Labs said the attackers appeared to have prepared for at least 36 hours before the theft, funding wallets in advance through the mixing service Tornado Cash. Binance has said an initial investigation traced the intrusion to a compromised engineer's laptop, though a later probe turned up additional "points of breach" the exchange has not yet detailed. The company says it found no evidence that a private wallet key was leaked and will release more technical findings once its investigation concludes, per CNBC.

"IT DOES LOOK LIKE A HACK ON BINANCE."

Binance says deposits were unaffected and withdrawals, suspended immediately after the breach, should resume within a day or two. Roughly $3 billion of the stolen funds has been frozen with the help of blockchain partners, the company said, and it has pledged to cover all customer losses while working with law enforcement. Binance founder Changpeng Zhao, who stepped down as CEO after a 2023 guilty plea and was pardoned by President Trump in 2025, posted that user funds remain safe but acknowledged "it does look like a hack on Binance."

North Korea has increasingly turned to crypto theft to fund its economy and weapons programs in the face of international sanctions; South Korea's spy agency has estimated the regime stole more than $1 billion in digital assets over a five-year stretch even before this week's attack. Binance has not said when its investigation will be complete.