The Liberty Daily 
(The Daily Caller)—North Korean hackers allegedly stole approximately $6.3 billion from cryptocurrency exchange Binance on Thursday in a record-breaking cyberattack that exposed vulnerabilities in the digital asset industry amid growing concerns over artificial intelligence-powered cybercrime.
The attack drained billions of dollars from Binance-controlled wallets in roughly 20 minutes, according to blockchain intelligence firm TRM Labs, which attributed the breach to North Korea’s state-sponsored TraderTraitor hacking unit. The massive theft unfolded as cybersecurity researchers warned that North Korean operatives were increasingly using AI to impersonate employees, develop malicious software and conduct sophisticated cyberattacks against financial institutions and cryptocurrency companies.
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the company said in an official statement Friday.
Trending: Major Fast-Food Chain Faces Wave of Restaurant Closures as Franchise Giant Files for Bankruptcy
The company said it found no evidence that wallet private keys were compromised, although its investigation uncovered additional potential points of intrusion.
TRM Labs reported that approximately $6.36 billion in cryptocurrency moved from Binance wallets across ten blockchains, including Bitcoin, Ethereum, Solana and Tron.
The firm said the attack appeared to involve compromised infrastructure responsible for authorizing cryptocurrency transactions, allowing the perpetrators to initiate unauthorized transfers across multiple blockchain networks.
Investigators also identified evidence that preparations began at least 36 hours before the theft, including transactions used to test the malicious code eventually deployed against Binance wallets.
TRM Labs attributed the operation to TraderTraitor, a North Korean hacking group previously linked to the $1.5 billion cryptocurrency theft from Bybit in February 2025.
The Federal Bureau of Investigation attributed the Bybit attack to North Korea, identifying TraderTraitor as responsible for stealing the digital assets.
The Binance theft was approximately four times larger than the Bybit attack, which previously ranked among the largest cryptocurrency heists on record.
Binance announced Friday that it worked with industry partners to freeze approximately $3 billion in affected assets, leaving billions more beyond its immediate control.
The company pledged to cover customer losses through its Secure Asset Fund for Users, an emergency reserve intended to protect customers, alongside additional corporate resources.
Binance said deposits were operating normally, although withdrawals remained temporarily suspended while security teams investigated the incident. The exchange expected withdrawals to resume within 48 hours.
Stablecoin issuers Tether and Circle were among the companies that helped freeze stolen assets, according to TRM Labs.
Investigators found that the perpetrators attempted to exchange stolen stablecoins for other cryptocurrencies before issuers could intervene, illustrating the challenges of recovering assets once they move beyond centralized financial controls.
The theft rattled cryptocurrency markets Friday, with Bitcoin falling to a six-week low and Ether declining to a two-month low, according to Reuters.
The Binance attack followed a separate security breach Thursday involving Polymarket, a prediction market platform that temporarily suspended international trading after a third-party provider was compromised.
Blockchain intelligence firm Bitquery identified approximately $2.73 million in unauthorized withdrawals affecting 737 accounts over roughly one hour.
Polymarket said it identified and resolved the vulnerability, referred the incident to law enforcement and would reimburse affected users. Trading subsequently resumed.
Investigators have not established a connection between the Binance and Polymarket attacks.
Microsoft Threat Intelligence warned Thursday that North Korean cybercriminal groups were increasingly incorporating AI into their operations, using the technology to research potential victims, generate convincing fraudulent identities and scale phishing campaigns.
The report identified North Korean hackers using AI to produce fabricated job applications, manipulate images and videos, impersonate recruiters and develop malicious content designed to deceive potential targets.
Microsoft assessed that AI adoption among North Korean hacking groups was widespread, although the operations remained directed by humans rather than fully autonomous systems.
The findings highlighted a growing cybersecurity concern: AI can make established hacking techniques faster, more convincing and more difficult for security teams to detect.
Google Threat Intelligence Group reported in September that North Korean cybercriminal operations were increasingly incorporating AI into cryptocurrency theft campaigns, including social engineering, software supply chain manipulation and automated backdoor development.
The researchers found that cybercriminals were moving beyond using AI to generate messages and increasingly employing automated tools to accelerate stages of an attack.
Google previously documented a North Korean-linked operation targeting a financial technology company through a compromised Telegram account, a fraudulent Zoom meeting and reportedly AI-generated video intended to deceive the victim.
Investigators have not publicly established that AI played a role in Thursday’s Binance attack, but the incident illustrated the potential financial consequences of security failures at major digital asset platforms.
Google’s September threat intelligence report also warned that AI-assisted cyberattacks could reduce the amount of time defenders have to detect and stop intrusions, identifying an operation in which attackers compromised a cloud resource and launched an AI-assisted credential harvesting campaign in less than six hours.
