Binance freezes $3 billion in assets after $6.36 billion theft

Binance has suspended withdrawals for its users while the exchange works to recover funds stolen in what analysts describe as the largest cryptocurrency theft on record. The world's biggest cryptocurrency exchange stated Friday that it is beginning to return assets to customers after freezing roughly $3 billion in affected holdings. The company confirmed that deposits were not impacted by the breach and promised to cover all user losses. Withdrawals are expected to resume within the next 24 to 48 hours.

Blockchain intelligence firm TRM attributed the attack to TraderTraitor, a unit it identifies as North Korea's elite hacking group. TRM stated in a post on its website Thursday that it makes this attribution with high confidence. The firm reported that an attacker moved approximately $6.36 billion out of Binance wallets across ten different blockchains. The majority of these funds were transferred in a span of about 20 minutes. This figure surpasses the $1.5 billion stolen from Bybit in February 2025, an incident the FBI also linked to North Korea.

Binance said an initial investigation suggested the incident involved a compromised laptop. A subsequent review uncovered additional points of breach, though the company has not yet released all technical details. On X, the company said it found no evidence of any wallet private key leak. It plans to publish more specifics once its internal probe is complete.

Jonathan Levin, co-founder and CEO of blockchain analysis company Chainalysis, wrote on X that the hack was likely done by the DPRK group TraderTraitor. DPRK is the official name for the Democratic People's Republic of Korea. A Binance spokesperson told the Associated Press that the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.

Changpeng Zhao, who founded Binance in 2017, posted on X on Thursday that user funds are safe. Zhao, who pleaded guilty to a felony related to money laundering in 2023 and was pardoned by President Donald Trump in 2025, said the theft looks like a hack on Binance. He added that as a shareholder, he expects all user funds to be fully covered.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, noted that the attack raises questions about approval controls. He said the incident appears to involve a single signature that granted the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys and are connected to the internet.

North Korea has increasingly relied on cyber activities to generate foreign currency for its economy and nuclear program. In December 2022, South Korea's spy agency estimated that North Korean hackers stole $1.1 billion in digital assets over the previous five years. More than half of that amount was taken in 2022 alone.

Binance remains the largest cryptocurrency exchange globally. The firm said it will continue to work with partners to finalize the recovery process for affected users.