Multiple blockchain research firms say North Korean hackers likely stole more than $6 billion in cryptocurrency from Binance, the world’s largest crypto exchange, in an attack on Thursday. Binance estimated the impact at $6.3 billion, while Chainalysis put the figure slightly higher at $6.4 billion.
TRM Labs said the group TraderTraitor, a subunit of North Korea’s Lazarus Group, was likely behind the attack, citing high confidence based on onchain and offchain intelligence. Chainalysis CEO Jonathan Levin also linked the hack to TraderTraitor through connections to a previous breach. Blockchain investigator ZachXBT said the attacker was likely Lazarus Group.
ZachXBT reported that stolen funds from Binance and the earlier Bitget hack ended up at the same address after moving through THORChain, indicating the same actor may be behind both incidents. Blockaid CEO Ido Ben-Natan said the tactics and sophistication matched past North Korean operations, and named the Kelp DAO, Bitget and Drift incidents as related examples.
Binance said in a late Thursday update that it had traced the attack vector to a compromised DevOps engineer’s laptop. One person familiar with crypto investigations cautioned that the hack had not been definitively attributed to Lazarus, and noted North Korean groups are usually faster at moving and selling stolen funds than the Binance hackers were on Thursday.
The Lazarus Group has been tied to some of crypto’s largest thefts, including the $1.46 billion Bybit hack in February 2025, the $292 million KelpDAO exploit in April, and the $625 million Ronin Network hack in 2022. US authorities have also linked TraderTraitor to the theft of more than $300 million from DMM Bitcoin in May 2024.
Reports suggest the Lazarus Group may now be connected to hacks totaling nearly $8.9 billion, including the Binance breach and earlier incidents involving Bybit and Bitget. The revelations are expected to increase scrutiny of exchange security and could lead to additional regulatory pressure across the crypto market.
