Binance, the world's largest cryptocurrency exchange, said it has frozen about $3 billion of the $6.3 billion taken in a hack that blockchain analysts have linked to North Korea.1,4,8
The company described the breach as complex and said about half of the stolen digital assets had been secured, while the remainder was still in the hands of unidentified hackers in what would be the largest cryptocurrency theft on record.1,4
The total amount differs slightly between accounts. The BBC put the figure at $6.3 billion, or £4.7 billion, while Breitbart put it at $6 billion. TRM Labs, a U.S.-based blockchain intelligence firm, said attackers moved approximately $6.36 billion out of Binance wallets across 10 blockchains, most of it within about 20 minutes. The amount eclipses the $1.5 billion, or £1.12 billion, taken from the Bybit exchange in February 2025.1,2,4
Binance initially indicated the breach may have started with a compromised DevOps engineer's laptop, which allowed unauthorized withdrawals. Its co-CEO Richard Teng later said the attack was wider. "This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach," Teng said. He said the hackers used "a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate."1
TRM Labs attributed the attack to TraderTraitor, which it described as an elite North Korean hacking unit. "We make this judgment with high confidence," TRM said in a report published Thursday. "Several features of this attack match earlier North Korea-linked heists, including the Bybit hack," the firm said. Jonathan Levin, co-founder and CEO of blockchain analysis company Chainalysis, also said the Binance attack was likely carried out by TraderTraitor. Chainalysis said it had "high confidence" that a North Korean is linked to the hack. The FBI had attributed the Bybit attack to North Korea and TraderTraitor. Investigators have also pointed to the Lazarus Group, also known as TraderTraitor, names that refer to clusters of cyber criminals accused of working directly for the government in Pyongyang.1,4,8
The U.S. Secret Service, the lead federal agency for investigating financial crimes, said it was "working around the clock" "to identify, freeze, trace, and recover" stolen funds and would "identify the cyber criminals responsible and bring them to justice." Binance said it was working with the FBI. While Binance said its U.S.-facing exchange was unaffected, the U.S. would still have jurisdiction to investigate the hack and help track down stolen funds, an effort which generally involves a global law enforcement effort. The hack also involved some U.S.-linked assets, such as stablecoins Tether and Circle, cryptocurrencies pegged to the dollar.1
Binance temporarily suspended deposits and withdrawals for security checks, a disruption that left users unable to trade on the platform while the suspected breach was investigated. It had initially suspended all deposits and withdrawals but then said in an update that "deposits remain unaffected." The company said it was recovering user assets and that deposits were unaffected by the attack. Binance, which was founded in China in 2017 and allows users to trade digital assets, is estimated to have more than 300 million registered users worldwide. The company said in 2024 that it had more than $160 billion in assets under its custody.1,3,4
Binance told its users "your money is safe, and we're covering every loss," and has said repeatedly that customer funds will be covered and that the firm is strong enough to weather the storm. A lot of the concern among Binance users and the crypto industry is whether Binance will be capable of covering the loss. NBC News led with the company's assurance that user funds are safe after thieves made off with billions in the largest-ever crypto hack.1,7
Observers of crypto history have noted online that similar assurances were given by FTX CEO Sam Bankman-Fried before his crypto exchange collapsed in 2022, leading to huge losses for customers and the industry. Several experts have warned customers not to regard Binance's promise to cover losses as legally binding and said they may need to pursue litigation to recover them. Daniel Tunkel, of the London-based Edwin Coe law firm, said that would "come down to what [customers] have been promised in their contracts," and "where Binance can be sued for non-performance, if it comes to it." Binance has been subject to regulatory scrutiny around the world.1
In the last five years the crypto industry has been beset by enormous losses from hackers, and in nearly all cases investigators have blamed hackers from North Korea. North Korea is a country with very little industry and heavy international sanctions, and experts say the government uses cyber crime as a way to bring money in. North Korea has always denied this, but the evidence from cryptocurrency flow analysis and insider interviews from defectors is described as compelling. That makes North Korea likely to be the only nation that uses hacking as a way to raise public funds.1
The Secret Service said it would continue efforts to trace and recover the stolen funds and to identify those responsible, while Binance said it is working with the FBI and that about $3 billion in affected assets had been frozen.1,4
