Binance Hit by Record $6.3 Billion Crypto Theft Linked to Lazarus Group

Attackers allegedly stole $6.36 billion from Binance in a record-breaking cryptocurrency exchange breach executed in less than half an hour. Investigators linked the attack to North Korea's Lazarus Group, pointing specifically to its premier hacking unit, TraderTraitor. Security researchers from TRM Labs based this assessment on robust on- and off-chain intelligence sources, noting the operation stands as one of the largest cyber heists in history.

Binance co-CEO Richard Teng confirmed via a LinkedIn post that a DevOps engineer's laptop was compromised during the incident. That initial access allowed the threat actors to reach a service container and submit unauthorized withdrawal transactions. However, executives stressed that the breach went far beyond a single compromised set of credentials. Teng noted that the multi-stage attack involved a complex process rather than a simple one-click action, exploiting networks across ten different blockchains including Ethereum, Bitcoin, Solana, and Polygon.

In response to the exploit, Binance temporarily restricted deposits and withdrawals while collaborating with international authorities and industry partners. Tether, Circle, Ripple, and World Liberty Financial quickly moved to freeze approximately $2.67 billion in stablecoins, while Arbitrum's Security Council locked down additional network assets. Teng assured users that customer funds were not compromised and that Binance would cover all losses utilizing the SAFU fund and corporate reserves.

Security firms immediately warned of secondary threats following the breach, highlighting the high probability of phishing campaigns targeting anxious crypto holders. NordVPN Chief Technology Officer Marijus Briedis advised users to avoid unsolicited links, fake support accounts, and panic-induced transfers, reminding the public to verify all platform updates directly through official applications.