Binance confirmed a $6.3 billion hack — the largest in crypto history — with investigators linking the breach to North Korea's TraderTraitor group. Around $3 billion in assets have been frozen as the exchange pledges to cover all customer losses.
Binance, the world's largest cryptocurrency exchange, confirmed Friday that hackers made off with approximately $6.3 billion in digital assets — the largest crypto hack on record — while investigators attributed the breach with high confidence to a North Korean state-sponsored group.
Around $3 billion in cryptocurrency has been frozen across blockchain networks so far, according to a Binance security update, with the exchange pledging to cover all remaining customer losses from its own reserves.
Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit, based on on-chain and off-chain intelligence. The FBI previously identified the same group as responsible for the $1.5 billion Bybit hack in February 2025.
TRM Labs said the attackers moved approximately $6.36 billion in digital assets from Binance wallets across 10 blockchains, with most of the transfers completed within about 20 minutes. Preparations for the breach began at least 36 hours in advance, with attackers using Tornado Cash, a cryptocurrency mixing service, to fund their wallets ahead of the theft, the firm said.
Chainalysis co-founder and CEO Jonathan Levin separately assessed that the hack was likely carried out by TraderTraitor, citing links to previous North Korea-attributed incidents.
Binance's initial investigation indicates hackers gained access to the firm's withdrawal systems and executed unauthorized transfers from its crypto wallets. The company said it found no evidence that the private keys controlling those wallets were leaked and that it is still investigating the full scope of the breach.
The exchange suspended deposits and withdrawals while the investigation proceeds. Binance maintains an emergency reserve fund known as SAFU, valued at approximately $1 billion, and has since said it has set aside more than $6.3 billion of its own funds to cover affected customers.
Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, estimated that roughly $3.3 billion in assets remained unfrozen. He said that assuming frozen stablecoins are eventually returned, the SAFU fund could cover roughly a third of the remaining shortfall, with the balance coming from exchange reserves.
"The most important takeaway for markets is that this does not currently appear to create meaningful solvency risk for Binance," Farrell said. He added that the key indicators to watch were how quickly the exchange resumes withdrawals and whether customer outflows remain orderly.
Bitcoin came under pressure following the news, trading below $78,000 on Friday.
The recovery of frozen assets remains a complex and potentially lengthy process. Ari Redbord, global head of policy at TRM Labs and a former U.S. federal prosecutor and Treasury official, told CNBC that a freeze prevents movement of funds, while actual recovery requires a separate legal process.
"Stablecoins are the most recoverable asset class in crypto because the issuer controls the token contract," Redbord said. "Tether and Circle can freeze, burn and reissue, which allows frozen USDT and USDC to be returned to a victim."
Bitcoin and ether present a harder challenge, as neither has a centralized issuer capable of directly freezing assets. Investigators must instead trace funds through public blockchains and attempt to intercept them at cooperating exchanges or other centralized platforms, Redbord said.
Eric Jardine, head of research at Chainalysis, told CNBC that there is "no standard recovery timeline," with a technical freeze potentially happening quickly while the actual return of funds can take months or years.
Martin Mulyadi, professor of accounting at Shenandoah University, cautioned that Binance's pledge to make customers whole is contingent on the resources backing it. "When you leave crypto on an exchange, you are relying on that company's controls and its balance sheet," Mulyadi said.
Chris Perkins, head of Franklin Crypto at Franklin Templeton, said the breach underscores the need for stronger cybersecurity standards and greater international coordination, pointing to regulatory cooperation among G20 nations after the global financial crisis as a potential model. He also noted that AI could play a role in identifying vulnerabilities, even as it is increasingly used by both attackers and defenders.
The breach arrives less than two months after Seychelles-registered exchange Bitget lost more than $387 million in a September 2026 hack, reinforcing a pattern of escalating attacks on centralized crypto platforms and intensifying calls from industry figures for binding international cybersecurity standards.
Sara Montes de Oca is the Editor in Chief of TechEchelon. Previously a correspondent and producer in Washington, D.C., covering business, finance, and politics.
More from Sara →Ukrainian national Artem Stryzhak was sentenced to 70 months in prison for his role as a ransomware affiliate with both the Nefilim and Hive groups, which prosecutors say caused more than $100 million in losses targeting hospitals and businesses across multiple countries.
The University of Copenhagen confirmed hackers accessed a test environment containing personal data for 525,000 people, including national identity numbers, with an additional 20,000 staff and student PIN codes also exposed.
Fifty-nine percent of U.S. employees say they are not fully prepared to spot modern payment scams, and only 23 percent say their company uses dedicated fraud-monitoring tools, according to research commissioned by payment-verification firm Eftsure.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.