About half of the affected assets have been frozen, although many may remain in the hackers’ possession. Binance has promised it will “cover all losses.”
Two analytics firms identified a North Korean hacking unit known as TraderTraitor as the suspected perpetrator. Cybersecurity firm Check Point said TraderTraitor is also known in the industry as Lazarus Group, which has been blamed for the 2025 $1.5 billion hack on Bybit exchange.
Check Point’s chief information security officer, Jayant Dave, said the losses Binance estimated made it “the largest crypto theft on record.”
Binance co-CEO Richard Teng said the company’s preliminary investigation indicated that the breach began after an engineer’s laptop was compromised.
“That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions,” he said in a statement.
Teng cautioned that the breach involved more than gaining access through a single employee’s permissions and said investigators had not assigned responsibility to any individual.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak.”
A detailed “post-mortem” will be released after the investigation is completed, Teng said.
Western security agencies have previously said money stolen in cyberattacks is directed toward North Korea’s nuclear weapons and missile development programs. North Korea has previously denied involvement in hacking operations.
Founded in China in 2017, Binance provides a platform for trading digital assets and is estimated to have more than 300 million registered users worldwide. The company has also faced regulatory scrutiny around the world.
