The North Korean hacker group TraderTraitor, also known as the Lazarus Group, may be responsible for the attack on Binance. The group is alleged to have stolen more than six billion dollars from the cryptocurrency trading platform.
The conclusion comes from blockchain analytics firms TRM Labs and Chainalysis, cited by the BBC. According to the British broadcaster, the group is also believed to have ties to Russia.
A report by UN Security Council experts, published in March 2024, states that the Lazarus Group is “very active in the Russian Federation” and has access to Russian computer systems, Meduza reports. In 2025, cybersecurity specialists also discovered that the hackers were routing internet traffic through servers located in the Russian town of Khasan, near the border with North Korea.
Binance’s preliminary investigation suggests that the attackers gained access to the system after compromising the laptop of one of the company’s engineers.
Binance representatives say they have managed to freeze roughly half of the stolen funds, but a substantial portion of the assets remains in the attackers’ possession. The company announced that it would compensate customers for their losses, setting aside $6.34 billion of its own funds for this purpose. It has also begun efforts to recover the stolen assets.
Experts describe the incident as the largest cryptocurrency theft ever recorded. The previous record was set by the February 2025 attack on the Bybit platform, when hackers stole approximately $1.5 billion. The TraderTraitor group was also identified as the prime suspect in that case.