North Korean state-linked hackers have reportedly stolen an estimated $6.36 billion in cryptocurrency from Binance, the world's largest crypto exchange, in what would be the largest digital asset theft ever recorded. U.S. blockchain intelligence firm TRM Labs attributed the attack, with 'high confidence', to TraderTraitor — a hacking group linked to Pyongyang — citing its analysis of on-chain transactions and striking similarities to earlier North Korean cyber operations.

How the Attack Unfolded

According to TRM Labs, the hackers began laying the groundwork at least 36 hours before executing the breach. They reportedly gained unauthorised access to systems that authorise cryptocurrency transfers, enabling them to move funds without detection. Strikingly, the bulk of the $6.36 billion was siphoned across 10 blockchain networks in roughly 20 minutes — a pace that underscores the precision of the operation.

Scale of Losses and Frozen Assets

Of the total stolen, approximately $2.7 billion in digital assets has been frozen through coordinated action among cryptocurrency firms and blockchain operators. However, the attackers reportedly still control roughly $2.4 billion worth of Bitcoin and Ethereum. TRM Labs warned that TraderTraitor may attempt to obscure the trail by shuffling funds across multiple blockchain networks and trading platforms — a laundering technique the group has used before.

Binance's Response

Richard Teng, co-Chief Executive Officer of Binance, confirmed the breach in a post on X, stating the company was 'working non-stop' to address it. 'We are committed to covering all hacked losses through our company funds. Your assets are safe,' he wrote. Teng added that Binance has reserved over $6.34 billion in company funds to cover the stolen assets, of which $5 billion was already held in the exact token assets affected.

Context: North Korea's Crypto Theft Record

The alleged theft would far surpass the $1.5 billion stolen from crypto exchange Bybit in February 2025 — an attack the U.S. Federal Bureau of Investigation (FBI) also pinned on TraderTraitor. U.S. officials have previously noted that North Korea relies on networks of its nationals abroad and foreign-based intermediaries — including in China, Russia, Cambodia, and Vietnam — to launder stolen digital assets into fiat currency, with proceeds allegedly funnelled into weapons of mass destruction programmes.

What Happens Next

With roughly $2.4 billion still under the hackers' control, the immediate priority for global crypto operators is tracking and blocking cross-chain movements. The episode is likely to intensify calls for tighter regulatory oversight of large centralised exchanges and their internal authorisation systems. How much of the remaining stolen funds can be recovered will depend on the speed of industry-wide coordination.