Binance recovers stolen crypto after $6.3B hack

Binance, the world’s largest cryptocurrency exchange, began returning frozen assets to users on Friday following a security breach that drained roughly $6.36 billion from its wallets.

The company stated that it has recovered approximately $3 billion in affected assets with the help of blockchain partners. Deposits remained open throughout the incident, but withdrawals were suspended for a day or two. Binance confirmed it will cover all financial losses for its customers.

Two U.S.-based blockchain intelligence firms independently linked the attack to North Korea. TRM identified the perpetrator as TraderTraitor, a unit it describes as the country's elite hacking team. TRM said it made this judgment with high confidence based on technical patterns. Chainalysis reached a similar conclusion, with co-founder and CEO Jonathan Levin writing on X that the hack was likely done by the same group.

TRM detailed the mechanics of the theft in a post on its website on Thursday. An attacker moved the funds across ten different blockchains. The bulk of the money was transferred in a span of about 20 minutes. This total makes the incident the largest cryptocurrency theft ever recorded.

The exchange released initial findings on social media, suggesting the breach may have started with a compromised laptop. Later investigations uncovered additional points of entry. Binance said it found no evidence that any wallet private keys were leaked, though it plans to share more technical details when its internal probe concludes.

Experts note that North Korea has relied on cybercrime to generate foreign currency for its economy and nuclear program in recent years. The FBI previously attributed a $1.5 billion hack on the exchange Bybit in February 2025 to the same North Korean unit. TRM noted that several features of the Binance attack matched those earlier heists.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, raised questions about the company's approval controls. He suggested the attacker used a single signature to obtain a full-access token for a Binance hot wallet. This token did not expire, allowing the unauthorized transfer of funds.

Changpeng Zhao, who founded Binance in 2017 and stepped down as CEO in 2023, commented on the event via X. Zhao, who was pardoned by President Donald Trump in 2025, said user funds are safe. He added that the incident looks like a direct hack on Binance and that he expects all user funds to be fully covered as a shareholder.

A Binance spokesperson told reporters that the company is working closely with law enforcement partners. The goal is to confirm the identity of the criminals and bring them to justice.