Binance Hack of $6.3 Billion Tied to North Korea's TraderTraitor Unit; Over $3 Billion Unrecoverable

Cybersecurity researchers attributed the $6.3 billion theft from Binance, the largest cyber heist on record, to TraderTraitor, an elite North Korean state-sponsored hacking unit, according to blockchain analytics firms. Hackers moved the funds out of Binance wallets within about 20 minutes on Thursday evening, and stablecoin providers froze roughly $2.8 billion, leaving more than $3 billion likely unrecoverable. Analysts at Elliptic, TRM Labs and Chainalysis said the attack matched TraderTraitor's methods. The group stole $1.5 billion from Bybit in February 2025 and $387 million from Bitget last month; its haul since January 2024 now exceeds $5 billion, funding Pyongyang's weapons programs. Binance said the breach may have involved a compromised DevOps engineer's laptop used to submit unauthorized withdrawal transactions. TraderTraitor operators typically pose as recruiters to trick employees into installing malicious software. U.S. officials say cybercrime funds roughly half of North Korea's missile program.