North Korea's elite hackers are the prime suspects in the $6.3bn Binance heist that may have begun with one engineer's laptop
Binance halted all withdrawals after a hack through a single engineer's laptop drained an estimated $6.3bn — surpassing the previous record $1.5bn Bybit breach in 2025.Kim Jong Un, whose country's TraderTraitor unit carried out the Binance raid using access gained through a compromised DevOps engineer's laptop, according to investigators.
North Korea's TraderTraitor unit stripped $6.36bn from Binance across ten blockchains in around 20 minutes on Thursday evening. Blockchain analytics firms TRM Labs and Chainalysis have both attributed the record-breaking heist to the Kim Jong Un-backed group "with high confidence." Binance co-CEO Richard Teng confirmed that attackers had exploited multiple entry points, and the exchange has set aside more than $6.34bn of its own funds to make customers whole. The haul eclipses the previous record — a $1.5bn raid on Bybit in February 2025, likewise pinned on TraderTraitor — and experts believe it may represent the largest single theft ever recorded across any category.
Roughly $3bn in assets has been frozen, but $2.4bn is beyond issuers' reach, already moved into non-freezable assets such as Bitcoin and Ethereum.
Rather than attacking code directly, hackers went after people — impersonating employers or investors to lure employees into installing malware, with AI potentially leveraged to exploit unknown software vulnerabilities.
