Crypto Heist: Binance reports $6.3 billion theft
North Korean hacking group TraderTraitor is suspected of stealing digital assets from the world's largest cryptocurrency exchange.
By Natalia Costa ·
A major shift in the relationship between the world's largest cryptocurrency exchange and illicit digital actors occurred when Binance became a target rather than a beneficiary. The company and its founder, Changpeng Zhao, have long faced accusations of facilitating criminal activity through their platform. On Thursday, that dynamic reversed as a hacking group allegedly stole an estimated $6.3 billion in bitcoin and other crypto assets from Binance customers.
This event appears to be the largest cryptocurrency heist in history. For much of its existence, the exchange has been a central figure in crypto news, often facing criticism for allowing the platform to be used by drug traffickers, money launderers, and terrorists. Zhao previously spent time in prison related to these charges. Now, a group possibly from North Korea has turned its attention against the company itself.
Founded in 2017 by Zhao, a former McDonald’s worker in Canada, Binance operates as a digital marketplace for buying and selling cryptocurrencies. Unlike traditional stock exchanges, it exists entirely online, allowing users with digital wallets to trade assets like bitcoin and ether. Zhao moved the company from Canada to Japan after a local crackdown and has since expanded its presence in Jersey and Malta. Through acquisitions and partnerships, including with an Israeli payments processor, the company surpassed rivals like Coinbase and FTX to become the market leader in trade volume.
As cryptocurrencies moved into the mainstream, regulatory scrutiny increased. Under the Bank Secrecy Act, U.S. financial institutions must verify customer identities and report suspicious activity. Zhao became the first person sentenced to prison time for violating this law in 2024. The charges against Binance included allowing hundreds of millions of dollars in trades between U.S. users and sanctioned Iranian users, and failing to report transactions involving groups such as Hamas’ Al-Qassam Brigades and al-Qaida. Zhao stepped down as CEO and served four months in jail.
In October of last year, President Donald Trump pardoned Zhao. Trump, who had shifted from critic to champion of the industry, stated that Zhao had been unfairly treated by his predecessor. The White House described the earlier enforcement as part of "The Biden Administration’s war on crypto." Binance has denied any direct exchange for the pardon, with attorney Teresa Goody Guillen calling claims of quid pro quo a "clear misstatement of the public record" in an email to The Associated Press.
U.S.-based blockchain intelligence firm TRM identified the theft on Thursday. The firm stated the attack was most likely carried out by TraderTraitor, an elite hacking unit from North Korea. Experts note that Pyongyang uses cryptocurrency to circumvent United Nations sanctions while funding its nuclear weapons program. South Korean spy agencies consider these hackers among the most skilled in the world.
Binance announced on Friday that it is beginning to recover funds for its users. The company is working with blockchain partners to freeze approximately $3 billion in affected assets. Earlier, Zhao posted on the social media platform X that user funds are safe. The company continues to coordinate with partners to secure the remaining stolen digital currency.
