Binance suffered a hack with an estimated impact of $6.3 billion, with approximately $3 billion in cryptocurrency assets frozen so far. The exchange pledged to cover all losses.
Blockchain investigators linked the attack to TraderTraitor, a North Korean state-sponsored hacking unit. TRM Labs attributed the breach with high confidence based on on-chain and off-chain intelligence. Chainalysis also assessed that TraderTraitor likely carried out the attack, citing links to previous incidents. The FBI previously identified the same group as responsible for the $1.5 billion Bybit hack in February 2025.
TRM Labs estimated that approximately $6.36 billion in digital assets moved from Binance wallets across 10 blockchains, with most transferred within about 20 minutes. Preparations for the attack began at least 36 hours before the theft, with attackers using Tornado Cash to fund their wallets ahead of the breach.
Freezing cryptocurrency prevents transfers, but recovery requires a separate legal process. Ari Redbord, global head of policy at TRM Labs, told CNBC that law enforcement typically obtains a court order or seizure warrant before working with stablecoin issuers. Stablecoins like USDT and USDC are most recoverable because issuers control the token contract and can freeze, burn and reissue them. Bitcoin and ether are harder to recover because they have no issuer that can directly freeze assets. Instead, investigators must trace funds through exchanges and other crypto services.
Eric Jardine, head of research at Chainalysis, said returning frozen assets requires coordination among law enforcement, exchanges and token issuers. There is no standard recovery timeline, with technical freezes happening quickly while returning funds can take months or years.
Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, said the attack does not currently appear to pose a significant solvency risk for Binance. Farrell estimated that around $3.3 billion in assets remained unfrozen. Assuming frozen stablecoins are eventually returned, Binance's SAFU emergency fund, worth approximately $1.2 billion, could cover roughly a third of the remaining losses, with the balance coming from the exchange's own funds. Farrell said key indicators to watch were how quickly Binance resumes withdrawals and whether outflows remain orderly.
Chris Perkins, head of Franklin Crypto at Franklin Templeton, called for stronger cybersecurity standards and greater coordination among governments to address the breach. He said AI could help improve cybersecurity by identifying vulnerabilities.
Bitcoin was trading below $78,000 on Friday and was under pressure.