A North Korean hacking group known as TraderTraitor, or Lazarus Group, may be behind the theft of more than $6 billion from the Binance cryptocurrency exchange, according to analytics firms TRM Labs and Chainalysis, the BBC reported.
The independent Russian investigative outlet Agentstvo notes that the group may have ties to Russia. A UN Security Council panel of experts said in a report published in March 2024 that Lazarus Group is “very active in the Russian Federation” and retains access to Russian systems. In 2025, cybersecurity researchers found that Lazarus had routed internet traffic through servers in the Russian village of Khasan, on the border with North Korea.
A preliminary review by Binance found that the attackers gained access to its system by hacking the laptop of one of its engineers. The exchange also discovered “additional points of breach.”
Binance announced that about half of the stolen funds have been frozen, but a significant portion remains in the hackers’ hands. The exchange has pledged to reimburse customers for their losses and has set aside $6.34 billion of its own funds for that purpose, and it announced that it has already begun returning the assets.
Experts consider the Binance attack the largest cryptocurrency theft in history. The previous record belonged to the Bybit exchange hack in February 2025, when hackers stole about $1.5 billion. TraderTraitor was also blamed for the Bybit hack.
At Meduza, we are committed to transparency about our use of artificial intelligence in the newsroom. The story you’re reading was written by one of our living, breathing journalists and translated from Russian using an AI model configured to follow our strict editorial standards. This translation process is the result of extensive testing and refinements to ensure our English-language coverage is timely and accurate. A Meduza editor reviews every draft before publication.
If you find any errors in this translation, please contact us at [email protected].
To read Meduza’s exclusive content in English, please subscribe to our newsletter.