Binance Hack Pinned on North Korea's TraderTraitor by TRM and Chainalysis, as CEO Teng Says Attack Was Not 'One-Click'

Since Binance disclosed that a security incident had hit its wallets, the story has shifted from how much was taken to who did it and how the attackers got in.

Who blockchain analysts say did it

TRM Labs and Chainalysis both attribute the heist to TraderTraitor, the cryptocurrency-focused North Korean hacking unit that investigators link to the Lazarus Group. TRM says it reached that judgment "with high confidence" and that several features of the attack match earlier North Korea-linked thefts.

TRM puts the haul at about $6.36 billion, moved out of Binance wallets across 10 blockchains. "Most of it" went in about 20 minutes, the firm said in a blog post.

Pangolin Intelligence, a Singapore-based tracking firm, reached the same conclusion. An unnamed Pangolin analyst told CNN the firm correlated on-chain activity with earlier known incidents. The analyst said North Korea is likely to use a network of money-laundering organizations to cash out.

TRM says the attackers were able to order Binance's own wallets to empty into hacker-controlled wallets. That mirrors the 2025 Bybit heist, which the FBI attributed to North Korea. The Bybit theft, at about $1.5 billion, was the previous record.

These are private-sector attributions. CNN says it asked the FBI and the Secret Service for comment. North Korea's mission in Geneva and its embassy in China did not immediately respond to Reuters. Pyongyang has previously denied hacking allegations.

Teng revises the account

Binance's first explanation pointed to a compromised engineer's laptop that gave an attacker access to a service container and let them submit unauthorized withdrawals. Teng has since said that picture was incomplete.

"The attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," Teng said, describing a more complicated attack process. He said the investigation has not attributed responsibility to any individual and has found no evidence of a wallet private key leak.

Binance said the incident "stems from multiple factors" and that its security team is tracing the full attack path. The laptop "may be the entry point," the company said. It has promised a detailed technical post-mortem once the investigation is finished.

Freezes, coverage of losses and the missing $3.3 billion

About $3 billion has been located and frozen, with stablecoin issuers Tether and Circle and the Trump-backed World Liberty Financial among those that froze assets, according to Reuters. Binance has given no update on the other $3.3 billion.

Binance co-founder Yi He said the exchange would cover "all hacking losses." Teng said funds from Binance's Secure Asset Fund for Users and company money would be used. The fund is a $1 billion bitcoin reserve, according to Binance's website, which is a fraction of the amount involved.

Binance has also not explicitly confirmed the theft figure. The $6 billion-plus numbers come from TRM and Chainalysis. The exchange has said deposits and withdrawals are suspended while security checks run.

Bobby Lee, founder of hardware wallet company Ballet Global, was blunt about the stolen bitcoin. "That's gone," he told Bloomberg. "The Bitcoin that's lost, that's all gone out into the hackers' hands."

Binance's position is the opposite on the question that matters to customers. "Your money is safe, and we're covering every loss," Teng said. Founder Changpeng Zhao, who was pardoned by President Trump in 2025 after pleading guilty in 2023 to a U.S. felony tied to money-laundering failures, posted that user funds are safe. He also said the incident "does look like a hack on Binance." As a shareholder, he said, he expects all user funds to be fully covered.

Market reaction

Bitcoin fell more than 3% in early Asian trading Friday to a six-week low of $76,368, according to Reuters. Al Jazeera reported that bitcoin fell about 5 percent following the heist, dropping below $77,000. Ether dropped more than 3% to a two-month low of $2,178. BNB, the token used to pay Binance fees, was down 5% over 24 hours at $709.70, per CoinGecko.

In extended U.S. trading Thursday, Coinbase shares slid 4.8% and Strategy shares fell nearly 6%.

Sean Foley, a crypto markets expert at Macquarie University, said a blow to confidence in a large centralized exchange "risks shocking confidence to many retail investors, which could dampen prices of crypto assets." Analysts cited by Reuters noted crypto was already under pressure from higher U.S. interest rates and softer demand from exchange-traded fund buyers.

Ari Redbord, TRM's global head of policy, called the attack "unprecedented" and a "watershed." He said North Korean theft at this scale funds weapons proliferation and other destabilizing activity, making it "a global security issue, not just a crypto theft."

What comes next

Binance expects withdrawal services to resume by Sunday morning, according to CNN. Reuters cites the company as saying within 45 hours. The test for that timeline is whether the technical post-mortem explains the full attack path, and whether the $3.3 billion that has not been accounted for turns up frozen or gone.