Binance begins restoring user funds after $6.3 billion North Korean hack

Binance, the world's largest cryptocurrency exchange, announced on Friday that it has begun recovering assets for users following a breach that stole approximately $6.36 billion. The company stated that it will cover all losses from the incident, which it identified as the largest cryptocurrency theft on record. Deposits to the platform remain open, but withdrawals are currently suspended. Binance expects to resume withdrawal services within the next one to two days.

The attack involved the movement of funds out of Binance wallets across ten different blockchains. Most of the money was moved in a span of about 20 minutes. Blockchain intelligence firm TRM attributed the heist to TraderTraitor, a hacking unit it identifies as North Korea's elite cyber force. TRM stated it makes this attribution with high confidence, noting that the attack's features match previous North Korea-linked thefts.

The incident follows a similar attack on the exchange Bybit in February 2025. In that case, hackers stole $1.5 billion, and the FBI confirmed that TraderTraitor was responsible. TRM noted that the Binance breach shares specific characteristics with the Bybit hack. Another analysis firm, Chainalysis, also concluded that the Binance attack was likely executed by the same North Korean group. Jonathan Levin, co-founder and CEO of Chainalysis, posted on X that the incident was likely done by the DPRK group TraderTraitor.

Binance initially reported on X that an early investigation pointed to a compromised laptop. However, a deeper probe subsequently uncovered additional points of breach. The company stated that it has found no evidence that any wallet private keys were leaked. It plans to release more technical details once its internal investigation is complete.

Changpeng Zhao, who founded Binance in 2017, commented on the situation on Thursday. Although he stepped down as CEO in 2023 after pleading guilty to a felony related to money laundering controls, he remains a shareholder. Zhao posted that user funds are safe and that the event looks like a hack. He added that he expects all user funds to be fully covered. President Donald Trump pardoned Zhao in 2025.

A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals. The exchange has frozen roughly $3 billion in affected assets in cooperation with blockchain partners. This freeze is part of the effort to recover the stolen digital currency before it is moved further or converted into other assets.

Cybersecurity experts point to the structure of the breach. Kok Tin Gan, cofounder and CEO of NyxLab, said the attack appears to have involved a single signature that granted the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets are connected to the internet and hold private keys, which are unique digital authorizations for accessing funds. Gan noted that the lack of stronger approval controls for such a token is a key question in the aftermath of the theft.

North Korea has increasingly relied on cryptocurrency hacking to generate foreign currency. The country uses these funds to support its economy and finance its nuclear program, particularly in response to United Nations sanctions. In December 2022, South Korea's spy agency reported that North Korean hackers stole an estimated 1.1 billion dollars in virtual assets over the previous five years. More than half of that total was stolen in 2022 alone. The agency described North Korea's ability to steal digital assets as among the best in the world.