Trump says US 'looking at' possible North Korean role in $6.3 billion Binance crypto heist

US President Donald Trump said Friday that the United States was investigating whether North Korean hackers were responsible for a massive cyberattack on cryptocurrency exchange Binance.

"We're looking at that," Trump told reporters in the Oval Office when asked whether the attack should be attributed to a North Korean hacker group. "It was a hack."

Binance said Friday that it was working to address a "complex attack" that affected approximately $6.3 billion in funds. The incident is believed to be the largest cryptocurrency heist ever recorded, with investigators pointing towards hackers linked to North Korea.

Blockchain investigation firm TRM Labs said it had "high confidence" that the attack was carried out by TraderTraitor, a hacking group affiliated with North Korea. The same group has been blamed for stealing $1.5 billion from cryptocurrency platform Bybit in February last year.

Another blockchain analytics firm, Elliptic, also linked the attack to North Korean hackers, according to industry publication CoinDesk.

Binance, the world's largest cryptocurrency exchange by daily trading volume, said its investigation had "uncovered additional points of breach." This differed from its initial findings, which indicated that the attack involved a single compromised laptop.

"This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it," Binance said in a post on X.

The company also confirmed through its Latin America X account that "the total estimated impact is around $6.3 billion." This is approximately four times the amount stolen in the Bybit hack, which was previously considered the largest cyberattack of its kind.

Binance cautioned that the estimated financial impact "may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets."

The cryptocurrency exchange also reported that approximately $3 billion worth of affected assets had been frozen.