Blockchain analysts said a North Korean hacking unit was likely behind the theft of more than $6 billion from Binance, the world's largest cryptocurrency exchange.

Binance temporarily suspended deposits and withdrawals for security checks and said about $3 billion in affected assets had been frozen.

US-based blockchain intelligence firm TRM attributed the attack to TraderTraitor, which it described as an elite North Korean hacking unit.

"We make this judgment with high confidence," TRM said in a report published Thursday.

Why do analysts suspect North Korea?
TRM said attackers moved approximately $6.36 billion out of Binance wallets across 10 blockchains, most of it within about 20 minutes. It described the incident as the largest cryptocurrency theft on record.

"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack," the firm said.

Bybit lost $1.5 billion in a hack in February 2025. The FBI attributed that attack to North Korea and TraderTraitor.

Jonathan Levin, co-founder and CEO of blockchain analysis company Chainalysis, also said the Binance attack was likely carried out by TraderTraitor.

Experts say North Korea uses cryptocurrency theft and other illicit cyber activities to obtain foreign currency and help fund its nuclear program despite international sanctions.

What has Binance said about the hack?
Binance did not confirm the attribution to North Korea, saying it was "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."

Binance said it worked to secure the affected assets and that it had located and frozen about $3 billion (€2.7 billion) so far. It did not provide information about the remaining $3.3 billion.

"Binance will cover all hacking losses," co-founder Yi He said, without providing more details about the incident.

"Rest assured that user funds are completely safe," a company spokesperson said.

Binance said its initial investigation suggested an attacker had compromised a software infrastructure engineer's laptop, gaining access to an internal service and submitting unauthorized withdrawals. The company said it had found no evidence that wallet private keys had leaked.

Tether froze around $1.6 billion in its USDT currency, according to CEO Paolo Ardoino, and Circle froze some $800 million-worth of USDC, boss Jeremy Allaire said.

The news of the possible hack sent Bitcoin's value tumbling by 3.2% on Thursday evening, dropping below $79,000.

Who is Binance ex-CEO Zhao?
Zhao, who founded the Binance platform in 2017, said "as a shareholder, I expect all user funds will be fully covered."

He stepped down as CEO after pleading guilty in 2023. to failing to prevent money laundering on his platform. US President Donald Trump pardoned him in 2025.

Zhao and Binance have been key supporters of cryptocurrency ventures by US President Donald Trump and his family.