The biggest cryptocurrency heist in history: North Korean hackers suspected

$6.3 billion has been stolen from Binance, the world’s largest cryptocurrency exchange. Three cybersecurity firms point the finger at a group linked to Kim Jong Un’s regime, which has already been accused of other attacks involving billions. Around half of the funds have been frozen 

30 OCT 26
Translated by AI
Image of The biggest cryptocurrency heist in history: North Korean hackers suspected

(Photo: Getty)

North Korean hackers are believed to be responsible for the largest cryptocurrency theft in history. On Thursday 29 October, approximately $6.3 billion was stolen from the digital wallets of Binance, the world’s largest cryptocurrency exchange, which has over 300 million registered users. Three companies specialising in monitoring digital transactions – TRM Labs, Pangolin Intelligence and Chainalysis – have identified the perpetrators of the attack as a group of hackers linked to Kim Jong Un’s regime. Most of the money was transferred in just twenty minutes.
According to TRM Labs, TraderTraitor – a North Korean hacking group already implicated in other billion-dollar thefts – is believed to be behind the operation. The American firm claims to have reached this conclusion with a high degree of certainty by comparing the attack’s modus operandi with that of previous cyber-attacks. For Pyongyang, which has been subject to heavy international sanctions for years, cryptocurrency thefts represent a major source of foreign currency, which is also used to fund military and nuclear programmes. In February 2025, the FBI attributed the theft of $1.5 billion from the Bybit platform to the same group – until yesterday, the largest such theft ever recorded.
As reported by CNN, following the attack on Binance, a race began between the hackers – who were busy moving and laundering the money – and companies specialising in tracing transactions. Around three billion dollars have already been frozen, thanks mainly to the intervention of Tether and Circle. Binance explained that, according to initial investigations, the attack may have originated from the compromised computer of one of its engineers, through which the hackers allegedly gained access to a system used to authorise withdrawals. The platform has temporarily suspended certain operations and assured users that it will cover all their losses. However, it has not yet confirmed North Korean involvement. Meanwhile, the news has triggered a fall in the value of the major cryptocurrencies, with Bitcoin dropping to its lowest level in the last six weeks.