Binance Freezes $3bn of $6.3bn in Record Hack Linked to North Korea

Binance has secured roughly $3 billion of the $6.3 billion in digital assets stolen in what investigators believe is the largest crypto heist on record — and it says customer money is safe. That's the hardest number in a story still moving fast: half the loot frozen, half still in unidentified hands.

The world's largest cryptocurrency exchange disclosed the breach after $6.3bn (£4.7bn) was accessed in a "complex" attack. The sum dwarfs the previous record, the $1.5bn (£1.12bn) heist on the Bybit exchange in 2025. Several analytics firms have already linked the attack to a North Korean hacking unit.

What happened in the attack?

Binance's initial theory was narrow: a compromised DevOps engineer's laptop allowed unauthorized withdrawals. That version didn't hold. Co-CEO Richard Teng said in a statement: "This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach."

Teng also detailed how the attackers covered their tracks, describing "a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate."

The breach touched US-linked assets, including the dollar-pegged stablecoins Tether and Circle. Binance says its US-facing exchange was unaffected, but the US retains jurisdiction to investigate and help trace stolen funds — an effort that typically spans global law enforcement.

The takeaway: this was a multi-vector intrusion, not a single stolen laptop, and the attackers knew how to burn evidence behind them.

Who is chasing the money?

The US Secret Service said it was "working around the clock" "to identify, freeze, trace, and recover" stolen funds. The agency, America's lead federal investigator of financial crimes, added that it would "identify the cyber criminals responsible and bring them to justice." Binance says it is also working with the FBI.

On the operations side, Binance initially suspended all deposits and withdrawals, then updated users that "deposits remain unaffected." The company told users directly: "your money is safe, and we're covering every loss."

In plain words: federal investigators and the exchange are running parallel recovery efforts, and the freeze perimeter is the first battleground.

Why investigators point to North Korea

TRM Labs, an AI-powered investigations company, said several elements of the attack resembled earlier North Korean-linked incidents, including the Bybit hack. Chainalysis, a crypto analytics firm, said it had "high confidence" that a North Korean is linked to the breach.

The pattern is familiar. Over the last five years, the crypto industry has absorbed enormous losses from hackers, and in nearly all cases investigators have blamed actors working for Pyongyang — pointing to the infamous Lazarus Group, also known as TraderTraitor. The names refer to clusters of cyber criminals accused of working directly for the regime.

North Korea, an impoverished country under heavy international sanctions, uses cyber crime as a way to bring in money, experts say. The regime has always denied it. But evidence from cryptocurrency flow analysis and interviews with defectors is, in the assessment of those experts, compelling — making North Korea likely the only nation that raises public funds through hacking.

Can Binance actually cover the losses?

Here's the number that matters for solvency: Binance said in 2024 that it held more than $160bn in assets under custody, and it claims more than 300 million registered users worldwide. The company, founded in China in 2017, has said repeatedly that customer funds will be covered and that the firm is strong enough to weather the storm.

Not everyone takes that promise at face value. Crypto history watchers have pointed out online that this is exactly the kind of message FTX CEO Sam Bankman-Fried gave before his exchange collapsed in 2022, triggering huge losses for customers and the industry.

Lawyers draw a harder line. Daniel Tunkel of the London-based firm Edwin Coe said any recovery would "come down to what [customers] have been promised in their contracts," and "where Binance can be sued for non-performance, if it comes to it." Several experts have warned customers not to regard Binance's pledge as legally binding — litigation may be the fallback.

The plain read: $6.3bn against $160bn in custody looks survivable on paper, but the promise's legal weight rests on contract language most users have never read.

What comes next

Binance already faces regulatory scrutiny around the world, and a record heist will intensify it. With half the stolen funds frozen, the recovery fight now hinges on tracing a trail the attackers deliberately destroyed — and on whether Washington's parallel criminal investigation can put names to the breach before the remaining $3.3bn moves beyond reach.