Binance, accused of profiting off crypto criminals, is allegedly robbed of an estimated $6.3B

TRM says the heist was most likely North Korea’s TraderTraitor hackers

Binance and its billionaire founder, Changpeng Zhao, have long been accused of profiting off crypto criminals. Now they are the victims: on Thursday, a hacking group possibly from North Korea allegedly stole an estimated $6.3 billion in bitcoin from the exchange’s customers, in what looks like the largest cryptocurrency heist in history.

Binance and Zhao have been front-page news for most of the crypto exchange’s short history, often in unflattering ways. He and his company have been accused of turning a blind eye as the exchange was used by drug traffickers, child abusers, terrorists and money launderers, and Zhao himself went to jail over the charges.

Binance said Friday it is beginning to recover money for users, working with blockchain partners to freeze roughly $3 billion in affected assets. Zhao posted earlier on X that “User funds are safe!”

The U.S.-based blockchain intelligence firm TRM announced Thursday that the $6.3 billion heist was most likely an attack by TraderTraitor, which it described as North Korea’s elite hacking unit. Experts say Pyongyang, desperate for foreign currency amid a push to develop nuclear weapons, has repeatedly turned to cryptocurrency to get around U.N. sanctions. A spy agency in South Korea considers crypto hackers north of the DMZ line among the best in the world.

Founded in 2017 by Zhao, Binance has become the world’s largest crypto exchange, operating like the New York Stock Exchange but for cryptocurrency: a digital meeting place offering speed, global reach and anonymity, where people controlling digital “wallets” buy and sell bitcoins, stablecoins, ether and other digital currencies that act like electronic cash. It doesn’t even have a headquarters building, and its ultimate owners are mostly shrouded in secrecy to the public.

Zhao, a former McDonald’s worker in Canada — where he had moved with his family from China — initially set up Binance in China. After Chinese authorities restricted cryptocurrency, he moved the company to Japan and has since hopscotched a bit around the world, with plans to expand in the island of Jersey and Malta.

Along the way, Binance bought a large cryptocurrency wallet, funded a kind of digital currency called a stablecoin, partnered with an Israeli payments processor, courted the Trump family and surpassed rivals including Coinbase and FTX to become the largest exchange in terms of trade volume. Forbes estimates Zhao is now worth more than $100 billion.

With success came scrutiny, lawsuits, jail time — then a reprieve by Trump. As cryptocurrencies moved from the financial fringes to the mainstream, scandals and market meltdowns mounted — most prominently the 2022 collapse of FTX, founded by crypto mogul Sam Bankman-Fried. Regulators under the Biden administration began targeting Binance and others for allegedly operating unregistered securities exchanges.

The Bank Secrecy Act requires U.S. financial institutions to know the identities of their customers, monitor transactions and file reports of suspicious activity. It was that law that eventually tripped up Zhao, who in 2024 became the first person ever sentenced to prison time after pleading guilty to violating it. The alleged crimes against Binance included allowing virtual currency trades worth hundreds of millions between U.S. users and users in Iran, in violation of sanctions, and failing to report suspicious transactions involving groups including Hamas’ Al-Qassam Brigades and al-Qaida. Zhao stepped down as CEO, expressed contrition and spent four months in jail.

Then came U.S. President Donald Trump, a onetime cryptocurrency critic turned champion who was given millions of dollars in campaign donations and funds for his 2025 inauguration. Zhao and Binance have also acted as key supporters of some of the Trump family’s crypto enterprises, including World Liberty Financial. In October of last year, Trump pardoned Zhao, saying that he had been unfairly treated by his predecessor in the Oval Office and that he would stop attacks on the industry, which the president calls a priority for the U.S.

Binance has denied there was a quid pro quo between its help and the pardon. “Any claim of a quid pro quo by Binance or CZ, or preferential financial treatment by Binance, is a clear misstatement of the public record,” attorney Teresa Goody Guillen said in an email to The Associated Press earlier this year, referring to Zhao by his initials. Asked about the pardon, the White House said federal authorities had unfairly punished Zhao in what it called “The Biden Administration’s war on crypto.”