- Attackers allegedly stole $6.36 billion from Binance in a record-breaking cryptocurrency exchange breach
- Investigators linked the attack to North Korea’s Lazarus Group, exploiting access from a compromised engineer
- Binance said customer funds remain safe, while authorities and partners froze billions in stolen assets
Cybercriminals, allegedly from an infamous North Korean hacking organization, have gained access to one of the biggest cryptocurrency exchanges on the planet – Binance – and in less than half an hour withdrew $6.36 billion worth of different tokens.
Security researchers TRM Labs said the attack was carried out by a group called TraderTraitor, which it describes as “North Korea’s premier hacking unit”.
“We base this assessment on robust on and off-chain intelligence sources,” TRM Labs said in a report, noting that TraderTraitor is part of Lazarus Group, North Korea’s state-sponsored threat actor blamed for some of the biggest crypto heists in history, with the FBI blaming it for the $1.5 billion Bybit hack that took place on February 21, 2025.
Gone in 20 minutes
Binance’s experts, as well as independent researchers, are still piecing together what happened, so information might change throughout the day(s). What we know so far is that a DevOps engineer had their laptop compromised, which was confirmed by Richard Teng, Binance co-CEO, in a LinkedIn post.
“That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions,” he said.
Right now, no one really knows what exactly happened and what it means that a DevOps engineer’s laptop was compromised. However, we do know that Lazarus is famous for running operations DreamJob and Contagious Interview, in which they set up fake companies and fake jobs, and then approach software engineers working on crypto projects. They entice them with lucrative job offers and exciting opportunities, and sneak malware during the multiple interview rounds.
But Binance’s security measures are more robust than that, and simply installing malware on one device could not have sufficed. Teng confirmed that, too, saying “the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process.”
Funds are SAFU
TRM Labs said the attackers pulled funds from 10 different chains, including Bitcoin, Ethereum, XRP, Tron, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. The Ethereum chain was the hardest one hit, losing roughly $3.79 billion. It could be because of the chain’s smart contracts feature, which allowed the attackers to keep withdrawing funds as they were landing into the wallet.
Binance is one of the biggest and most popular cryptocurrency exchanges on planet Earth, and as such it holds billions of dollars in user funds. This attack, however, did not target user funds, but rather Binance itself. This was confirmed by both Teng and TRM Labs, with the co-CEO saying “your funds are safe”, and “Binance will cover all losses from the SAFU fund and company funds.”
In response to the attack, Binance temporarily restricted deposits and withdrawals. Numerous users took to X this morning to say their transaction requests were denied. The police and other relevant entities were notified, and around $3 billion were already frozen on-chain, apparently.
Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, TRM Labs confirmed, while Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly $2.7 billion.
What’s particularly interesting about this incident is how the market responded. In 2013, when Mt.Gox (at the time the biggest crypto exchange in the world) got hacked for $450 million, it was considered a “black swan” event, sending bitcoin down by more than a third (35%) in a few weeks. The 2025 Bybit hack sent BTC down approximately 7.5%. In response to the Binance hack, BTC dropped a measly 6.7%, which is just another Friday in the crypto world.
Phishing incoming
Trouble always comes in pairs, and this Binance hack will most likely be no exception. Security researchers NordVPN are warning users that other hacking groups might try to take advantage of the news to target users with phishing emails.
“Another risk is criminals exploiting the confusion and fear among crypto owners on other platforms. An email claiming your funds are at risk, a fake support account offering help or a message urging you to move your cryptocurrency to a ‘safe wallet’ could be an attempt to steal from you,” said Marijus Briedis, Chief Technology Officer at NordVPN.
“Check updates through the Binance app or a website address you already trust. Avoid links in unsolicited messages, and never give anyone your password, verification codes or wallet recovery phrase. Pressure to act immediately should be a reason to pause and verify the request.”
“These steps can reduce the risk of someone taking over your account, but they cannot prevent a breach of the platform itself. Cryptocurrency firms typically have watertight cybersecurity, as they are digital-first businesses, so if one can be involved in the biggest hack in history, it shows just how lucrative a single flaw can be.”
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
