Attackers allegedly stole $6. 36 billion from Binance in a record-breaking cryptocurrency exchange breach
Investigators linked the attack to North Korea’s Lazarus Group, exploiting access from a compromised engineer
Binance said customer funds remain safe, while authorities and partners froze billions in stolen assets
Cybercriminals, allegedly from an infamous North Korean hacking organization, have gained access to one of the biggest cryptocurrency exchanges on the planet – Binance – and in less than half an hour withdrew $6. 36 billion worth of different tokens. Security researchers TRM Labs said the attack was carried out by a group called TraderTraitor, which it describes as “North Korea’s premier hacking unit”. “We base this assessment on robust on and off-chain intelligence sources,” TRM Labs said in a report, noting that TraderTraitor is part of Lazarus Group, North Korea’s state-sponsored threat actor blamed for some of the biggest crypto heists in history, with the FBI blaming it for the $1. 5 billion Bybit hack that took place on February 21, 2025. Gone in 20 minutes
Binance’s experts, as well as independent researchers, are still piecing together what happened, so information might change throughout the day(s). What we know so far is that a DevOps engineer had their laptop compromised, which was confirmed by Richard Teng, Binance co-CEO, in a LinkedIn post. “That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions,” he said. Right now, no one really knows what exactly happened and what it means that a DevOps engineer’s laptop was compromised. However, we do know that Lazarus is famous for running operations DreamJob and Contagious Interview, in which they set up fake companies and fake jobs, and then approach software engineers working on crypto projects. They entice them with lucrative job offers and exciting opportunities, and sneak malware during the multiple interview rounds. But Binance’s security measures are more robust than that, and simply installing malware on one device could not have sufficed. Teng confirmed that, too, saying “the attacker did not simply use one engineer’s permissions, and this was not a single "one-click" action. It involved a more complex attack process.” Funds are SAFU
TRM Labs said the attackers pulled funds from 10 different chains, including Bitcoin, Ethereum, XRP, Tron, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. The Ethereum chain was the hardest one hit, losing roughly $3. 79 billion…