Kim Jong Un's elite hackers are blamed for $6.3bn Binance heist that experts say helps fund North Korea's weapons
Binance halted all withdrawals after a hack through a single engineer's laptop drained an estimated $6.3bn — surpassing the previous record $1.5bn Bybit breach in 2025.Kim Jong Un, whose country's TraderTraitor unit carried out the Binance raid using access gained through a compromised DevOps engineer's laptop, according to investigators.
North Korea's TraderTraitor unit — also known as the Lazarus Group — is blamed "with high confidence" by blockchain analytics firms TRM Labs and Chainalysis for draining $6.36 billion from Binance wallets in roughly 20 minutes late on Thursday. Crypto expert Tom Robinson of Elliptic called it "almost certainly the largest theft of any kind in history," eclipsing Saddam Hussein's $1bn Baghdad bank raid in 2003. Binance co-CEO Richard Teng says the exchange has reserved more than $6.34 billion to cover every customer loss. Trump said Friday his administration is "looking at" the hack but added "we don't know" whether North Korea is responsible.
Hackers exploited a compromised engineer's laptop as the likely entry point, then used AI-powered techniques to detect hidden software flaws, Blockaid CEO Ido Ben-Natan said.
Around $3bn in stolen assets has been frozen so far, but $2.4bn remains beyond any issuer's reach, according to TRM Labs.
Crypto theft funds roughly half of North Korea's foreign currency income and helps bankroll Kim Jong Un's nuclear programme, which holds an estimated 50 warheads.
