$6.3 billion in crypto stolen from Binance, half seized, suspicion points to North Korea
Photo: Collected
The theft of $6.3 billion in digital assets from Binance, the world’s largest cryptocurrency exchange, has caused an uproar. The company has so far managed to seize about half of the stolen money, or $3 billion in assets. The rest remains in the hands of unidentified hackers. Cybersecurity analysts believe a North Korea-based hacker group was involved in the attack.
Binance said it initially believed the breach had occurred after an engineer’s laptop was hacked. A later investigation found evidence of security breaches in several places. The company’s co-chief executive Richard Teng said this was not an attack by a single individual. The hackers used special techniques to erase the technical tools they had used and the traces of the attack, making the investigation more complicated.
Crypto analytics firm TRM Labs says the pattern of the attack matches earlier cyberattacks linked to North Korea, one of which was the theft of $1.5 billion from the Bybit exchange in 2025. Another analytics firm, Chainalysis, also expressed a high degree of confidence in North Korea’s involvement.
The US Secret Service is working to trace and recover the stolen money. The agency said it is working round the clock to follow the money trail, seize and recover the assets and identify the cybercriminals involved. Binance is also working with the FBI.
The company said Binance’s US-based exchange was not affected by the attack. However, the stolen assets include US-linked stablecoins pegged to the dollar, such as Tether and Circle.
Reassuring customers, Binance said their money is safe and that the company will make good any losses customers suffer because of the theft. However, concern has arisen in the crypto market over its ability to repay such a huge sum. Some analysts have warned that the promise of compensation cannot be regarded as a legally binding guarantee, and that those affected may have to go to court if necessary.
According to London lawyer Daniel Tunkel, whether compensation will be paid depends on the terms of Binance’s agreements with its customers and on the scope for legal action against the company if it fails to keep its promise.
Founded in 2017, Binance has more than 300 million registered users worldwide. Over the past five years, investigators have blamed several major cyber thefts in the crypto sector on North Korean hacker groups, including the Lazarus Group. Experts believe North Korea uses cybercrime to raise money amid international sanctions and limited economic activity. Pyongyang, however, has always denied these allegations.
Background
According to an Al Jazeera report of 30 October 2026, the theft began on the night of Thursday, 29 October, and most of the money was moved within about 20 minutes.
The same report said TRM Labs blamed ‘TraderTraitor’, a North Korean unit linked to the Lazarus Group; the FBI had also blamed this unit for the Bybit hack in February 2025.
By the numbers
According to Chainalysis, North Korea stole a little over $2 billion in crypto in 2025, 51 per cent more than the previous year, The Register reported on 18 December 2025.
Sources
Original report: Ajker Patrika
Background sources: Al Jazeera, 30 October 2026; The Register, 18 December 2025
