North Korean hackers have been linked to the theft of approximately $6.3 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange, in what cybersecurity experts describe as the biggest crypto heist on record.

Blockchain intelligence firms, including TRM Labs and Elliptic, have identified North Korea’s TraderTraitor hacking group, believed to be associated with the notorious Lazarus Group, as the likely perpetrators of the October 29 attack.

The hackers reportedly carried out the operation within about 20 minutes, targeting Binance’s digital asset wallets across multiple blockchain networks.

Investigations indicate that the attackers may have gained access to Binance’s systems through a compromised laptop belonging to an engineer working with the exchange.

The breach reportedly allowed them to access an internal service container and initiate unauthorised cryptocurrency withdrawals.

Binance said its preliminary investigation had found no evidence that its wallet private keys were leaked, although investigations into how the attackers gained access were still ongoing.

The exchange also maintained that customers’ funds were safe and pledged to cover all losses resulting from the incident.

According to blockchain security researchers, approximately $3 billion of the stolen cryptocurrency had been traced and frozen through cooperation among Binance, stablecoin issuers and other industry partners.

Billions of dollars in digital assets remained under the attackers’ control as efforts to trace and recover the funds continued.

TRM Labs and Chainalysis expressed high confidence in North Korean involvement, citing similarities between the Binance attack and previous cryptocurrency thefts attributed to the country’s cybercrime networks.

TraderTraitor has previously been linked to major cryptocurrency thefts, including the $1.46 billion attack on Dubai-based exchange Bybit in February 2025.

North Korean-linked hacking groups have repeatedly been accused of targeting cryptocurrency platforms and financial institutions to generate revenue for the isolated country’s government.

International security experts have also warned that proceeds from such cyberattacks could support North Korea’s weapons development and other sanctioned activities.

The Binance breach has renewed concerns about the security of cryptocurrency exchanges, particularly the risks associated with internal systems and employees’ access to sensitive financial infrastructure.