Binance begins returning funds after $6.3 billion theft

Binance, the world's largest cryptocurrency exchange, announced on Friday that it is beginning to return stolen assets to users following a breach that drained approximately $6.36 billion from its wallets. The exchange stated that deposits were not affected by the incident, but it has suspended withdrawals. Those services are expected to resume within the next day or two.

The company told customers it will cover all losses from the theft. In a post on X, Binance explained that an initial investigation pointed to a compromised laptop. A deeper review later revealed additional points of breach. The firm said it found no evidence that any wallet private keys leaked and plans to release further technical details when its probe concludes.

Blockchain intelligence firm TRM attributed the attack to TraderTraitor, a unit it describes as North Korea's elite hacking group. TRM stated in a post on its website that the judgment is made with high confidence. The firm noted that an attacker moved the funds across ten different blockchains, with the majority of the transfer occurring in about 20 minutes. This event marks the largest cryptocurrency theft on record.

Chainalysis, another blockchain analysis company, reached a similar conclusion. Co-founder and CEO Jonathan Levin wrote on X that the hack was likely done by the DPRK group TraderTraitor. The Democratic People's Republic of Korea is the official name for North Korea. Binance spokespersons said the company is working closely with law enforcement partners to confirm the identity of the criminals.

This attack follows a similar incident in February of last year. At that time, the exchange Bybit suffered a $1.5 billion loss. The FBI attributed that hack to North Korea and TraderTraitor. TRM noted that several features of the current Binance attack match those earlier heists. Experts say North Korea has relied on crypto hacking to generate foreign currency to support its economy and fund its nuclear program under U.N. sanctions.

Changpeng Zhao, who founded Binance in 2017, posted on X that user funds are safe. Zhao pleaded guilty to a felony in 2023 related to money laundering controls and stepped down as CEO. President Donald Trump pardoned Zhao in 2025. As a shareholder, Zhao said he expects all user funds to be fully covered despite no longer managing the company.

Kok Tin Gan, co-founder of cybersecurity firm NyxLab, questioned why stronger approval controls were not in place. He said the attack appeared to involve a single signature that gave an attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold users' private keys and are connected to the internet.