North Korea-linked hackers stole 18,270 Bitcoins — worth about $1.4 billion — as well as ethereum, stablecoins and other digital assets in the largest single hack in the industry’s history.
WASHINGTON — Hackers linked to North Korea have stolen more Bitcoin from Binance than the amount held by Tesla or the El Salvadoran government, cryptocurrency-focused media reported on Sunday.
North Korea-linked hackers stole a cumulative 18,270 Bitcoins — worth about $1.4 billion at a market price of $78,500 apiece — from Binance, the world’s largest crypto exchange, on Thursday, according to CoinDesk and Cointelegraph.
The haul exceeds Tesla’s Bitcoin holdings of 11,509 coins by 59 percent and comes close to the 18,712 coins held by the Elon Musk-led aerospace company SpaceX.
It is also 2.3 times the 7,820 Bitcoins held by El Salvador’s government, which adopted the cryptocurrency as legal tender in 2021.
The stolen $1.4 billion in Bitcoins is worth nearly three times North Korea’s annual merchandise exports. The country exported just $468.59 million in goods last year, according to the Korea Trade-Investment Promotion Agency.
The theft reportedly included other cryptocurrencies, with North Korea-linked hackers also taking substantial amounts of ethereum, stablecoins and other digital assets.
The total value of the stolen crypto is estimated to be $6.3 billion, making the breach the largest single hack in the industry’s history. The theft dwarfs the roughly $1.5 billion that North Korea-linked hackers stole from cryptocurrency exchange Bybit in February 2025.
The FBI formally identified North Korean hacking group TraderTraitor as responsible for the attack in a statement released on Saturday. The announcement marked the first official confirmation by U.S. investigators of the group’s suspected involvement in the breach. TraderTraitor has also been linked to the 2025 Bybit hack.Â
Binance said that it has recovered or frozen about $3 billion of the stolen assets on the blockchain. The exchange is also using its own funds to cover customer losses and is investigating how the hackers accessed its systems.
BY KANG TAE-HWA [lee.soojung1@joongang.co.kr]