Binance freezes $3 billion after largest crypto hack in history

Binance, the world's largest cryptocurrency exchange, is recovering user assets after a breach that drained approximately $6.36 billion from its wallets. The exchange stated on Friday that it began the process of returning funds to customers. It has suspended withdrawals, which are expected to resume within the next one to two days. Binance confirmed that deposits were not affected by the incident.

The company announced it will cover all losses associated with the hack. In a post on X, Binance noted that an initial investigation pointed to a compromised laptop, but a deeper review identified additional points of entry. The firm said it found no evidence that private keys for its wallets were leaked. It plans to share more technical details once its investigation concludes.

Blockchain intelligence firm TRM attributed the attack to TraderTraitor, a unit it described as North Korea's elite hacking team. TRM stated it made this judgment with high confidence. The firm reported that an attacker moved the $6.36 billion across ten different blockchains, with the majority of the transfer occurring in about 20 minutes. TRM labeled the incident the largest cryptocurrency theft on record.

Chainalysis, another blockchain analysis company, reached a similar conclusion. Co-founder and CEO Jonathan Levin wrote on X that the hack was likely executed by the same North Korean group. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identities of the criminals. The exchange did not confirm the North Korean link in its initial public statements.

This incident follows a pattern of large-scale thefts by North Korean actors. In February of last year, the exchange Bybit lost $1.5 billion to a hack that the FBI attributed to TraderTraitor. TRM noted that several features of the Binance attack matched those earlier North Korea-linked heists. Experts indicate that North Korea uses crypto hacking to generate foreign currency for its economy and nuclear program, particularly after facing strict United Nations sanctions.

In December 2022, South Korea's spy agency estimated that North Korean hackers had stolen 1.5 trillion won, roughly $1.1 billion, in virtual assets over the previous five years. More than half of that total was stolen in 2022 alone. The agency described North Korea's capacity to steal digital assets as among the best in the world.

Changpeng Zhao, known as CZ, founded Binance in 2017. He pleaded guilty to a felony related to money laundering in 2023 and stepped down as CEO. President Donald Trump pardoned Zhao in 2025. Zhao posted on X on Thursday that user funds are safe. He acknowledged that the incident appears to be a hack on Binance. As a shareholder, he said he expects all user funds to be fully covered.

Cybersecurity experts are examining the technical controls that failed. Kok Tin Gan, cofounder and CEO of NyxLab, said the attack suggests a single signature granted the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets are connected to the internet and hold the digital authorizations needed to move funds. Gan noted that stronger approval controls might have prevented the full access.