Binance Theft: North Korean Unit Stole $6.3 Billion

Binance confirmed it was the target of a coordinated cyberattack that drained an estimated $6.3 billion in digital assets. The exchange pledged to cover all customer losses from the breach. Approximately $3 billion in cryptocurrency has been frozen to date, halting the transfer of those specific tokens.

TRM Labs attributed the incident to TraderTraitor, a North Korean state-sponsored hacking unit. The firm stated with high confidence that the attack shared characteristics with previous North Korea-linked thefts, including extensive preparation and the use of pre-obtained transaction signatures. Preparations began at least 36 hours before the theft, with attackers using Tornado Cash to fund their wallets.

TRM Labs estimated that roughly $6.36 billion moved from Binance wallets across ten different blockchains. Most of these transfers occurred within a 20-minute window. Chainalysis also assessed that TraderTraitor was likely responsible, citing links to the $1.5 billion Bybit hack in February 2025.

Ari Redbord, global head of policy at TRM Labs, explained that freezing assets stops movement but does not recover funds. Recovery requires a legal process where law enforcement obtains court orders or seizure warrants. Redbord noted that stablecoins are the most recoverable asset class because issuers like Tether and Circle control the token contract. They can freeze, burn, and reissue tokens to return them to victims.

Recovering bitcoin and ether is more difficult because they lack a central issuer. Eric Jardine, head of research at Chainalysis, said investigators must trace these assets on public blockchains. Funds can be intercepted when they reach a cooperating exchange or centralized platform. Jardine noted that while technical freezes happen quickly, returning funds can take months or years.

Bitcoin traded below $78,000 on Friday, showing pressure on the market. Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, assessed that the attack does not currently pose a solvency risk for Binance. Farrell estimated that about $3.3 billion in assets remain unfrozen.

Farrell projected that Binance's SAFU emergency fund, valued at approximately $1.2 billion, could cover roughly a third of the remaining losses if frozen stablecoins are returned. The exchange would cover the balance with its own funds. He identified the speed of withdrawal resumption and the orderliness of outflows as key indicators for market stability.

Chris Perkins, head of Franklin Crypto at Franklin Templeton, called for stronger cybersecurity standards and greater international cooperation. He suggested that G20 regulatory coordination following the global financial crisis serves as a potential model. Perkins emphasized the need to hold cybercriminals accountable while improving defenses against both human and AI-driven threats.