Binance begins returning stolen funds after $6.36 billion hack

Binance announced on Friday that it is beginning to return assets to users following a massive cyberattack. The world's largest cryptocurrency exchange said it has frozen approximately $3 billion of the affected funds. Deposits are currently open, but withdrawals have been paused. The company expects to resume withdrawals within the next one to two days. Binance stated it will cover all losses incurred by the hack.

Blockchain intelligence firm TRM attributed the attack to a North Korean unit called TraderTraitor. TRM reported on Thursday that the attackers moved approximately $6.36 billion out of Binance wallets across ten different blockchains. The majority of this transfer occurred in about 20 minutes. TRM described this as the largest cryptocurrency theft in history. The firm said it made this judgment with high confidence.

Chainalysis also linked the incident to the same group. Jonathan Levin, co-founder and CEO of Chainalysis, wrote on X that the hack was likely done by the Democratic People's Republic of Korea group TraderTraitor. He noted that several features of the attack matched previous North Korea-linked heists. This includes the Bybit hack from February of last year. In that incident, Bybit suffered a $1.5 billion loss. The FBI stated that North Korea and TraderTraitor were responsible for that earlier breach.

A Binance spokesperson said the company is working closely with law enforcement partners. The goal is to confirm the identity of the criminals and bring them to justice. Binance initially suggested on X that a compromised laptop may have been involved. However, subsequent investigations uncovered additional points of breach. The company has not yet released full technical details of how the attackers gained access.

Cybersecurity experts are examining the security controls in place during the incident. Kok Tin Gan, cofounder and CEO of NyxLab, said the attack appeared to involve a single signature. This signature gave the attacker a full-access token to a Binance hot wallet that never expired. Hot wallets hold users' private keys and are connected to the internet. Gan noted that this setup raises questions about approval controls. Binance stated on X that it found no evidence of any wallet private key leak.

Changpeng Zhao, the founder of Binance, commented on the event on X. He said user funds are safe, although the incident looks like a hack on the platform. Zhao stepped down as CEO in 2023 after pleading guilty to a felony related to money laundering. President Donald Trump pardoned Zhao in 2025. As a shareholder, Zhao said he expects all user funds to be fully covered.

North Korea has increasingly used crypto hacking to generate foreign currency. This helps support its economy and fund its nuclear program under United Nations sanctions. In December 2022, South Korea's spy agency estimated that North Korean hackers stole 1.5 trillion won in digital assets over five years. That amount equals roughly $1.1 billion. More than half of that total was stolen in 2022 alone. The agency described North Korea's capacity to steal digital assets as among the best in the world.

Binance will provide more technical details once its probe is complete. The company continues to work with blockchain partners to track the frozen assets. The recovery process for user funds has officially begun as of this week.