Global cryptocurrency trading platform Binance has suffered what has been described as the largest cryptocurrency theft in history, losing $6.3 billion in a cyberattack on Thursday and exposing critical security vulnerabilities across the digital financial infrastructure.
The unprecedented loss far exceeds the previous record set in February 2025, when North Korean state-sponsored hackers stole $1.5 billion from cryptocurrency exchange Bybit.
Security analysts and industry experts have warned that risks facing digital assets are escalating rapidly as perpetrators increasingly use artificial intelligence (AI) and automated tools to carry out cyber heists and launder stolen funds, reports The New York Times.
According to a blog post published on Friday by blockchain analytics firm Chainalysis, the attackers used unprecedented laundering mechanisms to execute the Binance breach. Thousands of transactions were carried out within a short period, indicating the use of automated systems to obscure the movement of funds.
Although the precise entry point remains under investigation, Binance initially said an engineer’s laptop had been compromised before later clarifying that investigators had identified additional points of breach. Both Chainalysis and TRM Labs attributed the operation to North Korea.
In response, Binance, which processes billions of dollars in daily transactions, guaranteed full compensation for affected users and said it had set aside more than $6.3 billion in corporate reserves to cover the losses.
Recovery efforts have resulted in $3 billion worth of stolen digital assets being frozen by issuers, including Circle and Tether, preventing North Korean operatives from accessing the funds. Binance said it was actively working to recover the frozen assets.
However, TRM Labs reported that the hackers had already transferred $2.4 billion worth of cryptocurrency beyond the reach of any issuer.
North Korean hacker unit TraderTraitor blamed
Analytics firm TRM Labs identified the perpetrators as TraderTraitor, an elite North Korean cyber warfare unit.
Chainalysis supported the attribution after finding that the stolen Binance funds had been mixed with digital assets taken during a cyberattack on another cryptocurrency exchange, Bitget, the previous month.
News of the breach began circulating on social media on Thursday afternoon as analysts tracked sudden withdrawals on the publicly visible blockchain ledger. According to Chainalysis, the stolen funds began leaving Binance at around 4:20pm on Thursday in what it described as a programmatic laundering sequence.
Commenting on the growing technological capabilities of cybercriminals, Eswar Prasad, an economics professor at Cornell University who monitors the cryptocurrency market, said AI was significantly enhancing hackers’ ability to identify and exploit subtle weaknesses across the crypto ecosystem. He predicted that the scale and scope of such attacks would increase.
Joshua Saxe, chief technology officer at AI security firm Abundant Security, observed that North Korea had sophisticated threat actors capable of carrying out major breaches even before the emergence of AI. However, he said the technology was democratising advanced hacking, allowing many more actors to attempt large-scale heists.
Experts warn of systemic risks and sanctions evasion
Tom Robinson, chief scientist and co-founder of cryptocurrency analytics firm Elliptic, said the Binance heist would almost double North Korea’s total recorded cryptocurrency thefts.
While agreeing with the attribution, Robinson noted that North Korean groups typically operate more quickly and efficiently when transferring funds to evade asset freezes.
Ciaran Martin, former head of national cyber defence in the United Kingdom, said state-backed hackers recognised that security at cryptocurrency exchanges was often extremely poor compared with that of traditional banks.
“They’re good at exploiting that,” Martin said, adding, “This is their best day at the office yet”.
In an official statement, the Federal Bureau of Investigation (FBI) confirmed that it was aware of the incident and was working with relevant public and private sector partners to assess its impact, understand the scope of the activity and coordinate appropriate investigative measures.
Previous record-breaking Bybit heist
The scale of the Binance breach highlights a worsening trend that reached a previous record in February 2025.
During that attack, North Korean hackers tricked Bybit chief executive officer Ben Zhou into approving what appeared to be a routine transaction. They subsequently gained control of the exchange’s systems by exploiting a flaw in a free software product used to safeguard customer deposits.
Although a security firm described Bybit’s $1.5 billion loss as “completely preventable”, the exchange survived the disruption by drawing on its corporate reserves and borrowing funds from rival cryptocurrency companies.
Established in 2017, Binance quickly became the dominant player in the digital currency sector, processing up to two-thirds of all global cryptocurrency transactions. It operates as a major marketplace for buying digital currencies such as Bitcoin and Ether and converting traditional currencies into cryptocurrencies.
Following Thursday’s breach, Binance founder Changpeng Zhao sought to reassure investors through social media platform X, writing, “It hurts, but we will survive”, accompanied by a muscle emoji.
Zhao has previously faced regulatory challenges. Binance pleaded guilty to money-laundering violations in 2023 and paid a $4.3 billion fine to the US government.
After serving a four-month prison sentence, Zhao received a presidential pardon from US President Donald Trump last year. Binance has also established a business relationship with World Liberty Financial, a cryptocurrency company affiliated with the Trump family.
The breach has drawn attention to longstanding structural weaknesses in the cryptocurrency market, which has faced major thefts since its emergence in 2008 as an unregulated alternative to traditional banking.
While users of self-custody wallets risk losing their funds permanently if they misplace their passwords, centralised exchanges such as Binance hold customers’ assets without being subject to the strict regulatory safeguards imposed on traditional banks.
Despite President Trump’s endorsement of the industry as part of efforts to bring it into the mainstream, some cryptocurrency firms continue to struggle to protect customers’ funds.
Western intelligence officials have long warned that acquiring cryptocurrency through illicit means is a major way for North Korea to evade international sanctions and finance its nuclear weapons programme, which Pyongyang considers vital to the regime’s survival.
