North Korea Hackers Execute Record $6.3B Binance Heist

Binance reported a security incident affecting $6.3 billion in assets, surpassing all previous cryptocurrency thefts. An attacker gained initial access through a DevOps engineer’s compromised laptop, using it to penetrate a service container and execute unauthorized withdrawals. Stablecoin issuers and blockchain protocols have already frozen nearly $3 billion of the stolen funds.

The attack displayed sophisticated technical execution. Rather than targeting private keys directly, the attacker obtained pre-signed authorizations for 50 consecutive transaction nonces—a technique that guaranteed successful execution as the hot wallet’s transaction counter naturally advanced. This strategy enabled them to transfer 167,464 ETH and multiple tokens worth approximately $5.9 billion in minutes. Blockchain analysts attributed the breach to North Korea’s TraderTraitor group, responsible for the February 2025 Bybit theft ($1.5 billion) and the April 2026 KelpDAO hack.

Response efforts have frozen roughly $2.67 billion in stablecoins through multiple issuers, with blockchain protocol Arbitrum securing another $30 million. Binance confirmed private keys remained intact and committed to covering all user losses through its insurance fund. The exchange suspended deposits and withdrawals temporarily for security improvements, planning to resume operations within 48 hours. At the time of reporting, attackers retained approximately $2.4 billion across various blockchains.