Binance hack: $6.3 billion stolen, $3 billion frozen as North Korea link probed

Binance has said it will cover all losses from a $6.3 billion hack and temporarily suspended deposits and withdrawals while investigating. About $3 billion in cryptocurrency assets have been frozen so far, as blockchain investigators link the attack to North Korea and analysts assess the fallout.

What happened

TRM Labs said approximately $6.36 billion in digital assets were moved from Binance wallets across 10 blockchains, with most transferred within about 20 minutes. The firm said preparations began at least 36 hours before the theft, with attackers using Tornado Cash, a cryptocurrency mixing service, to fund their wallets ahead of the breach.

TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, based on on-chain and off-chain intelligence. The FBI previously identified the same group as responsible for the $1.5 billion Bybit hack in February 2025. TRM Labs said the Binance attack shared characteristics with previous North Korea-linked incidents, including preparations made well before the theft and transaction signatures obtained in advance. Chainalysis also pointed to North Korea, with co-founder and CEO Jonathan Levin saying the firm assessed that the $6.4 billion Binance hack was likely carried out by TraderTraitor, citing links to previous attacks.

Recovery and solvency

Ari Redbord, global head of policy at blockchain intelligence firm TRM Labs and a former U.S. federal prosecutor and Treasury official, said freezing crypto prevents it from being transferred, but recovery requires a separate legal process. "A freeze stops the money from moving, and recovery follows through legal process," Redbord said. He said law enforcement typically obtains a court order or seizure warrant before working with stablecoin issuers to release or reissue assets and return them to their rightful owners.

"Stablecoins are the most recoverable asset class in crypto because the issuer controls the token contract," he said. "Tether and Circle can freeze, burn and reissue, which allows frozen USDT and USDC to be returned to a victim." But recovering bitcoin and ether is more challenging because they have no issuer that can directly freeze the assets, Redbord added. Investigators must trace funds through exchanges and other crypto services where they can potentially be intercepted.

Eric Jardine, head of research at blockchain analytics firm Chainalysis, said returning frozen assets requires coordination among law enforcement, exchanges and token issuers. "There is no standard recovery timeline. A technical freeze may happen quickly, while returning funds can take months or years," Jardine said. He added that while bitcoin and ether cannot be frozen by an issuer, they can still be traced and potentially recovered. Investigators can trace the funds on public blockchains and intervene when they reach a cooperating exchange or another centralized platform.

Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, said the breach does not currently appear to pose a significant solvency risk for Binance. "The most important takeaway for markets is that this does not currently appear to create meaningful solvency risk for Binance," Farrell said. He estimated that around $3.3 billion in assets remained unfrozen. Assuming frozen stablecoins are eventually returned, Binance's SAFU emergency fund, worth approximately $1.2 billion, could cover roughly a third of the remaining losses, with the balance coming from the exchange's own funds.

Farrell said the key indicators to watch were how quickly Binance resumes withdrawals and whether outflows remain orderly. He added that a shortfall in customer assets could force the exchange to sell reserves, potentially triggering broader selling across crypto markets. "I do not think that is the setup we are dealing with, but the key tell will be how quickly withdrawals resume and whether outflows stay orderly," Farrell said.

Market and policy fallout

Bitcoin was under pressure on Friday and was trading below $78,000. The Binance hack underscores the need for stronger cybersecurity standards and greater coordination among governments, according to Chris Perkins, head of Franklin Crypto at Franklin Templeton. Speaking on Squawk Box Asia, Perkins said the industry must address cybersecurity challenges to reach its full potential, calling for stronger defenses and policies to hold cybercriminals accountable. "We need to make sure standards are incredibly high, but we have to really focus on the criminals," Perkins said.

Perkins called for greater international cooperation to address cybersecurity threats, pointing to regulatory coordination among G20 countries following the global financial crisis as a potential model. He also said AI could help improve cybersecurity by identifying and addressing vulnerabilities, even as the technology is used by both attackers and defenders.