North Korea's elite hackers are blamed for the record $6.3bn Binance heist that may have begun on an engineer's laptop
Binance halted all withdrawals after a hack through a single engineer's laptop drained an estimated $6.3bn — surpassing the previous record $1.5bn Bybit breach in 2025.Kim Jong Un, whose country's TraderTraitor unit carried out the Binance raid using access gained through a compromised DevOps engineer's laptop, according to investigators.
North Korea's TraderTraitor unit — also known as the Lazarus Group — drained $6.36bn from Binance wallets across at least six blockchain networks, with much of the theft completed in just 20 minutes on Thursday evening. Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic all attributed the attack "with high confidence" to the elite state-backed hacking group. Binance co-CEO Richard Teng confirmed the breach began at "additional points of entry" beyond the compromised laptop, and pledged the exchange has reserved more than $6.34bn to cover every customer loss.
Experts regard it as the single biggest theft in human history by any method, eclipsing Saddam Hussein's $1bn Central Bank raid in 2003.
Around $3bn in assets has been frozen, but $2.4bn remains beyond any issuer's reach — already converted into non-freezable assets such as Bitcoin and Ethereum.
Crypto hacking funds roughly half of North Korea's foreign currency income and helps bankroll Kim Jong Un's nuclear weapons programme, analysts say.
