North Korea Linked to $6.3bn Binance Hack Following Engineer Laptop Breach

Hackers stole $6.3bn from Binance in a record theft that US blockchain analysts attributed to North Korea. The attack targeted wallets across ten blockchains, prompting immediate market declines and a scramble by stablecoin issuers to freeze millions in stolen assets.

Hackers targeted wallets used by Binance, emptying funds into attacker-controlled addresses in a raid that lasted approximately 20 minutes late on Thursday. US blockchain analysis firms TRM Labs and Chainalysis identified the culprits as state-backed actors from North Korea, pointing specifically to TraderTraitor, the country’s elite hacking unit.

TRM Labs noted that several characteristics of the breach mirrored prior attacks linked to Pyongyang, including a 2025 heist at the cryptocurrency exchange Bybit that the US Federal Bureau of Investigation had attributed to Pyongyang. We make this judgment with high confidence, TRM Labs stated regarding its attribution.

Compromised Engineer Laptop and Binance Emergency Response

An initial investigation conducted by Binance suggested that the security breach may have originated from a hacked laptop belonging to one of the exchange’s engineers. That compromised computer allowed an attacker to access internal systems and execute unauthorized withdrawals.

Mark Karpeles, former chief of the defunct Tokyo-based exchange Mt. Gox—which collapsed a dozen years ago after $500m in bitcoin was stolen—suggested that attackers likely accessed private keys for at least two Binance wallets. He observed that while Binance appears to have split its assets across multiple systems to limit exposure, a single breach still resulted in massive losses.

In response to the exploit, Binance suspended deposits and withdrawals while its security teams traced the attack path and secured wallet infrastructure. Richard Teng, a co-chief executive of Binance, addressed users directly on social media.

Your money is safe and we’re covering every loss.

Richard Teng, co-chief executive of Binance

Binance co-founder Yi He stated that the exchange would cover all hacking losses using its own funds alongside reserves. The platform operates a secure asset fund intended to protect user assets during security breaches, which is a reserve held entirely in bitcoin.

Industry-Wide Asset Freezes and Multi-Billion Recovery Efforts

Following the exploit, major cryptocurrency infrastructure providers and stablecoin issuers scrambled to intercept the stolen funds. Binance reported that it had worked with partners to locate and freeze roughly $3bn of the stolen assets so far, though it did not immediately specify the status of the remaining $3.3bn.

Stablecoin issuer Tether announced that it had frozen nearly $1.57bn in assets linked to the incident, while Circle froze more than $800m. Additional freezes came from across the digital asset sector as platforms moved to block transactions tied to the hacker wallets.

Entity	Action Taken
Tether	Froze nearly $1.57bn in linked assets
Circle	Froze more than $800m
Ripple	Froze roughly $200m in funds
World Liberty Financial	Froze $2m in tokens via BitGo

World Liberty Financial, a crypto company linked to US President Donald Trump and his family, reported that it worked with cryptocurrency custodian BitGo to freeze stolen funds. Binance’s Yi He noted that $27m in stablecoins and about $2m worth of World Liberty tokens had been successfully frozen, alongside roughly $200m frozen by crypto firm Ripple.

Global Market Reactions and Centralised Exchange Risks

Cryptocurrency markets dropped immediately during Asian trading sessions following news of the breach. Bitcoin fell more than 3% to a six-week low of $76,368, and Ether dropped more than 3% to a two-month low of $2,178. BNB, the native token used to pay fees on Binance, fell 5% over a 24-hour period to $709.70, according to CoinGecko.

North Korea Linked to $6.3bn Binance Hack Following Engineer Laptop Breach — Photo: irishexaminer.com

Equities tied to the digital asset sector also suffered in extended trading. Shares in exchange operator Coinbase Global slid 4.8%, while bitcoin buyer Strategy saw its shares fall nearly 6%. Both Coinbase and Binance.US stated that their separate platforms were unaffected by the incident.

Binance Cyberattack Linked to North Korea's TraderTraitor Hacking Group, TRM Labs Says | NewsX

Industry analysts warned that the historic theft could create long-term headwinds for centralized platforms. Tim Sun, a senior researcher at HashKey Group based in Hong Kong, noted that the breach may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges.

Bernardo Brites, CEO of payments and stablecoin infrastructure company Trace Finance, highlighted the growing technological challenges facing asset custodians. It’s becoming very hard to counter hacks as AI can find vulnerabilities faster than you can fix them, Brites said, adding his view that users will increasingly migrate away from smaller and medium-sized exchanges deemed incapable of covering a major hack.