Binance Tracks Billions in Crypto After Record Hack Linked to North Korea

Binance, the world’s largest cryptocurrency exchange, is trying to trace and recover about $6.3 billion in digital assets affected by what blockchain analysts describe as the largest cryptocurrency theft on record. The company says approximately $3 billion has been frozen or secured, while the fate of the remaining funds remains unclear. TRM Labs, a US-based blockchain intelligence firm, attributed the attack with high confidence to TraderTraitor, a hacking unit linked by investigators to North Korea.

Chainalysis chief executive Jonathan Levin also said the operation was likely carried out by the group. Both firms said the methods resembled previous North Korean-linked cryptocurrency heists, including the $1.5 billion Bybit breach in 2025. TRM said attackers moved approximately $6.36 billion across 10 blockchains, most of it within about 20 minutes.

Binance has not confirmed the North Korean attribution, saying it is working with law-enforcement partners to identify the criminals and bring them to justice. The United States Secret Service said it was working to identify, freeze, trace and recover the stolen funds, while Binance confirmed cooperation with the FBI. The exchange initially said an attacker may have compromised the laptop of a software or DevOps engineer, gaining access to an internal service and submitting unauthorised withdrawals.

Binance co-chief executive Richard Teng later said the investigation had found additional points of breach and that the incident was not the work of a single person. He said the attackers used a mechanism that destroyed tools and traces, complicating the investigation. Binance temporarily suspended deposits and withdrawals while it conducted security checks, although subsequent updates said deposits were unaffected.

The company said there was no evidence that wallet private keys had been leaked. Its US-facing exchange was reported unaffected, but US authorities can still investigate because the incident involved US-linked assets and international transactions. Stablecoin issuers Tether and Circle have separately frozen assets believed to be connected to the hack.

Tether chief executive Paolo Ardoino said about $1.6 billion in USDT had been frozen, while Circle chief executive Jeremy Allaire said roughly $800 million in USDC had been blocked. Binance said it would cover hacking losses, and later said it had set aside more than $6.34 billion in company funds while actively buying affected tokens. The company has repeatedly told customers that their funds are safe.

However, the BBC reported that legal experts have warned such assurances may not automatically be legally binding and that customers’ ability to recover losses could depend on the terms of their contracts. The scale of the incident has also unsettled markets: Bitcoin fell by between 3.2 per cent and 5 per cent in the reports, dropping below $79,000 and later to about $76,800. Analysts say North Korea has used cryptocurrency theft and other cyber operations to obtain foreign currency despite international sanctions, with experts linking the proceeds to the regime’s broader financial needs, including its nuclear programme.

North Korea has denied such accusations, and the investigation into the Binance breach is continuing.