Binance customers’ account balances remain untouched, but they cannot move funds off the exchange while withdrawals are suspended. The company says it has set aside more than $6.34 billion of its own funds to cover the stolen assets.
TRM Labs, a blockchain investigation firm, said it had “high confidence” that TraderTraitor, a group affiliated with North Korea, orchestrated the attack. Chainalysis and Elliptic also attributed it to hackers linked to North Korea. TraderTraitor is believed to be part of the Lazarus Group.
On Friday morning, executives at Binance, the world’s largest cryptocurrency exchange, discovered a complex attack that had moved approximately $6.36 billion from Binance wallets across ten blockchains, most of it in about 20 minutes. Binance said the attack affected around $6.3 billion in funds, in what is thought to be the biggest cryptocurrency heist to date.
Richard Teng, Binance’s co-chief executive, said in a video posted to X on Friday: “We are working nonstop to resolve this”.
Binance initially suspended deposits and withdrawals. It later said deposits were unaffected, while withdrawals would remain suspended and were expected to resume in the next day or two. At about 0900 GMT Friday, the exchange said it was on track to restore withdrawals in 45 hours.
An early investigation indicated that a DevOps engineer’s laptop may have been compromised, allowing unauthorised withdrawals. Binance later found additional “points of breach”, indicating that the intrusion was wider than first believed.
Kok Tin Gan, the co-founder and chief executive of cybersecurity firm NyxLab, said: “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet”.
Binance and its blockchain partners froze roughly $3 billion in affected assets. A Binance spokesperson said around 80% of the stolen assets had been secured, and the company said it would cover all customer losses.
Changpeng Zhao, Binance’s founder, wrote on X on Thursday that “User funds are safe!” He added: “as a shareholder, I expect all user funds will be fully covered”. Zhao founded Binance in 2017, pleaded guilty in 2023 to a felony linked to failing to prevent money laundering, and was pardoned by President Trump in 2025.
The FBI said TraderTraitor had moved quickly to launder and disperse the assets, converting them into Bitcoin and other digital assets in an effort eventually to turn them into hard currency. Jake Moore, a global cybersecurity adviser at ESET, said attackers would be “trying to create red herrings” and use a process called “washing” to turn funds into other cryptocurrencies. He said they would spend “the next year or so trying to lose that trail”.
Joe Hancock, head of cyber risk and complex investigations at Mishcon de Reya, said the process could last far longer. “Laundering will likely take place over weeks or months if not longer,” he said.
TraderTraitor is also blamed for the $1.5 billion theft from the Bybit platform in February last year. Lazarus Group gained notoriety in 2014, when it was accused of hacking Sony Pictures.
North Korea has developed cyber operations by recruiting promising university students into hacker groups overseen by its intelligence agency, with some cyberwarfare conducted just over its border in China. The country has severely restricted internet access.
In December 2022, South Korea’s spy agency said North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion US) in cryptocurrency and other virtual assets over the previous five years, with more than half taken in 2022 alone. The agency said North Korea’s ability to steal digital assets ranked among the best in the world.
Experts believe North Korean hackers stole at least $2.02 billion in cryptocurrency in 2025.
President Donald Trump said Friday that the United States was looking into the Binance hack. The FBI said it was “engaged with relevant public and private partners to understand the scope of the activity” and was ready to investigate. The US Secret Service said it was “working around the clock” with partners to help track the stolen funds.
Comments (0)