Hackers linked to North Korea have been identified as the culprits behind a massive cyberattack on Binance, the world’s largest cryptocurrency exchange, resulting in the theft of at least $6.3 billion worth of crypto assets. This heist is now considered the largest crypto theft in history. The breach occurred after attackers compromised a Binance engineer’s laptop, which enabled unauthorized access to internal systems and led to the illicit withdrawal of funds. Binance has frozen about half of the stolen assets as they moved across multiple blockchains, and the investigation remains ongoing.

Binance disclosed that the initial attack vector involved a "compromised" employee device, which allowed hackers to submit unauthorized withdrawal transactions without evidence of any private key leaks. The exchange halted all deposits and withdrawals to safeguard user assets and promised an updated proof of reserves when the remediation is complete. Despite the gravity of the incident, a spokesperson assured that user funds are currently safe, with about $3 billion frozen through collaborative efforts with industry partners, law enforcement, and blockchain intelligence firms.

Security experts from companies like TRM Labs and Elliptic have attributed the attack to a North Korean hacking group known as TraderTraitor. This group reportedly specializes in stealing cryptocurrency from large exchanges and companies and was also responsible for a $1.4 billion theft from crypto exchange Bybit in 2025. Researchers note that the latest Binance breach was executed within 20 minutes, and some stolen funds were traced to wallets used in previous high-profile attacks, including a recent $351 million crypto theft from Bitget earlier in 2026.

The incident raises questions about Binance’s cybersecurity protocols, especially regarding how a single compromised employee laptop could grant access to billion-dollar wallets. While Binance has yet to comment on any prior security audits or stress tests of its systems, the attack underscores the vulnerabilities exposed through supply chain risks and compromised software components commonly exploited by hackers. The U.S. and allied governments have long warned about North Korea’s aggressive cybertheft activities aimed at funding its banned nuclear weapons program, highlighting the geopolitical stakes behind these large-scale crypto breaches.