Binance freezes $3 billion after North Korean hackers drain $6.36 billion

Binance, the world's largest cryptocurrency exchange, confirmed on Friday that it has begun recovering assets for users after a massive hack that impacted more than $6 billion. The company worked with blockchain partners to freeze roughly $3 billion in affected assets. Deposits remain open, but withdrawals are suspended and are expected to resume within the next day or two. Binance stated it will cover all losses incurred by users during the incident.

Blockchain intelligence firm TRM attributed the attack to TraderTraitor, a unit it describes as North Korea's elite hacking group. In a post on its website on Thursday, TRM said it makes this judgment with high confidence. The firm reported that an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains. Most of the funds were moved in about 20 minutes, making this the largest cryptocurrency theft on record according to TRM.

Chainalysis, another blockchain analysis company, also linked the hack to North Korea. Jonathan Levin, the company's co-founder and CEO, wrote on X that the incident was likely done by the DPRK group TraderTraitor. The Democratic People's Republic of Korea is North Korea's official name. TRM noted that several features of the attack matched earlier North Korea-linked heists, including the $1.5 billion hack of Bybit in February of last year. The Federal Bureau of Investigation previously attributed the Bybit breach to North Korea and TraderTraitor.

Binance explained the technical cause of the breach in an update on X. An initial investigation suggested the incident involved a compromised laptop. A subsequent investigation uncovered additional points of breach. The company said it found no evidence of any wallet private key leak. It plans to release more technical details once its probe is complete. A spokesperson for Binance said the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, raised questions about the company's internal controls. He said the attack appears to have used a single signature that granted the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys, which are digital authorizations connected to the internet. Gan suggested that stronger approval controls might have prevented the breach.

Changpeng Zhao, known as CZ, founded Binance in 2017. He pleaded guilty to a felony in 2023 related to money laundering controls and stepped down as CEO. U.S. President Donald Trump pardoned Zhao in 2025. Zhao posted on X on Thursday that user funds are safe. He added that the theft looks like a hack on Binance. As a shareholder, he expects all user funds will be fully covered.

North Korea has increasingly turned to cryptocurrency hacking to support its economy and fund its nuclear program. The country faces tough United Nations sanctions and other economic difficulties. In December 2022, South Korea's spy agency reported that North Korean hackers had stolen an estimated $1.1 billion in cryptocurrency over the previous five years. More than half of that amount was stolen in 2022 alone. The agency described North Korea's capacity to steal digital assets as among the best in the world.

The hack places Binance in the center of a growing trend of state-sponsored cybercrime. The exchange faces pressure to demonstrate its security improvements while restoring user trust. The suspension of withdrawals is a standard measure to prevent further loss, though it temporarily limits user access to their funds. The company's commitment to cover all losses aims to mitigate the financial impact for individual users.

Binance will continue its investigation to determine the full scope of the breach. The company has not yet announced when all operations will return to normal. Analysts will continue to track the movement of the stolen funds across the ten blockchains involved. The identification of TraderTraitor as the likely attacker provides a clear target for law enforcement efforts.

The incident underscores the risks associated with centralized cryptocurrency exchanges. While hot wallets offer convenience, they also present a single point of failure. The rapid movement of funds by the attacker highlights the speed at which digital assets can be transferred. Binance's response and the subsequent analysis by blockchain firms provide a case study in modern cyber defense.