Oct. 29 (UPI) — Cryptocurrency behemoth Binance acknowledged Thursday that it was experiencing a “security incident” that investigators believe involved the theft of some $6.3 billion by North Korean hackers.
Separately, U.S.-based blockchain intelligence firm TRM Labs said hackers believed to be operating for North Korea moved $6.3 billion from Binance wallets on 10 blockchains on Thursday, most of it over a span of 20 minutes starting at 4:05 p.m. EDT, with a second wave of unauthorized transfers from Binance wallets occurring about three hours later.
TRM Labs attributes the hack to TraderTraitor, a group of North Korea-sponsored malicious cyberactors, the same group U.S. authorities hold responsible for the February 2025 theft of $1.5 billion from the Bybit cryptocurrency exchange, previously the largest confirmed cryptocurrency theft.
“Our teams are aware of reports of a potential security issue and are actively investigating,” Binance said in a social media statement, explaining withdrawals were suspended but would be resumed once the security issue is resolved.
Binance said in an online statement it had experienced a “security incident” and that “the estimated total impact sits at around $6.3B.”
“We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.”
It said users funds are safe and that it will cover all losses through its emergency fund and company assets.
“Our teams are working around the clock to resolve this issue safely and thoroughly,” it said.
According to Binance’s preliminary investigation, the incident may involve a compromised DevOps engineer’s laptop. It said the attackers may have gained access to a service container through the device and submitted unauthorized withdrawal transactions.
“We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice,” it said.
North Korea employs teams of hackers who carry out sophisticated cyberattacks, stealing billions of dollars a year that the U.S. Treasury says Pyongyang uses to finance its nuclear weapons and ballistic missile programs. According to U.S.-based Chainalysis, North Korean hackers stole $2.02 billion in 2025, including the Bybit attack, bringing their estimated cumulative thefts to $6.75 billion through last year.