Binance said its initial investigation suggests a security breach with an estimated impact of about $6.3 billion may have involved a compromised laptop belonging to one of the exchange’s DevOps engineers.
That access allowed an attacker to reach a service container and submit unauthorized withdrawal transactions, according to the crypto exchange’s preliminary findings. Binance said it had found no evidence that any wallet private key was leaked. Virginia Times has not independently verified the company’s account of how the attacker got in or its loss and reserve figures.
About $3 billion of the affected assets has been frozen on-chain with help from blockchain partners. The company pledged to cover all losses through its SAFU fund and its own money, and it said user funds are safe.
In a later post on X, Binance said it had begun recovering affected assets for users. It has reserved more than $6.34 billion in company funds for the incident, and $5 billion of that is already held in the exact tokens that were affected.
The exchange is buying the remaining amount through market and over-the-counter channels to match the remaining affected tokens and cover any shortfalls. That step could take longer because some tokens have low liquidity and OTC settlement takes time, the post said.
Those figures do not include frozen or protected assets, which are still subject to recovery and verification. Binance said it continues to work with law enforcement, token issuers, blockchain intelligence firms and industry partners to trace, freeze and recover more funds.
“We will weather this storm,” Binance wrote.
As a precaution, the exchange temporarily suspended withdrawals while security checks are completed. It also revoked authorization for the affected address and engaged law enforcement and blockchain intelligence partners to trace and recover the funds.
An earlier Binance post on X said deposits had been suspended as well. The company later updated its announcement to clarify that deposits remain unaffected and continue to operate normally.
North Korea link
Blockchain intelligence firm TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, CNBC reported. TRM said its finding was based on on-chain and off-chain intelligence.
The FBI previously identified the same group as responsible for the $1.5 billion Bybit hack in February 2025, according to TRM Labs.
By TRM’s estimate, about $6.36 billion in digital assets was moved from Binance wallets across 10 blockchains, most of it within about 20 minutes. The firm said preparations began at least 36 hours before the theft, with the attackers using the mixing service Tornado Cash to fund their wallets.
TRM said the attack shared characteristics with earlier North Korea-linked incidents, including preparations made well in advance and transaction signatures obtained ahead of time.
Chainalysis also pointed to North Korea. Co-founder and CEO Jonathan Levin said the firm assessed that the hack, which it put at $6.4 billion, was likely carried out by TraderTraitor, citing links to previous attacks.
Neither attribution has been independently verified. Binance said it is working with law enforcement partners to confirm the identity of those responsible.
Getting frozen funds back
A freeze keeps crypto from moving, but recovering it requires a separate legal process, said Ari Redbord, global head of policy at TRM Labs and a former U.S. federal prosecutor and Treasury official.
“A freeze stops the money from moving, and recovery follows through legal process,” Redbord told CNBC. Law enforcement typically obtains a court order or seizure warrant before working with stablecoin issuers to release or reissue assets and return them to their rightful owners, he said.
Stablecoins are the most recoverable crypto assets because the issuer controls the token contract, Redbord said. Tether and Circle can freeze, burn and reissue tokens, allowing frozen USDT and USDC to be returned to a victim.
Bitcoin and ether are harder to recover because no issuer can directly freeze them. Investigators must instead trace the funds through exchanges and other crypto services where they can potentially be intercepted, Redbord added.
Eric Jardine, head of research at Chainalysis, said returning frozen assets requires coordination among law enforcement, exchanges and token issuers.
“There is no standard recovery timeline,” Jardine told CNBC, adding that a technical freeze may happen quickly while returning funds can take months or years. Bitcoin and ether can still be traced on public blockchains and potentially recovered when they reach a cooperating exchange or other centralized platform, he said.
Market fallout
Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, said the attack does not currently appear to create meaningful solvency risk for Binance.
Farrell estimated that about $3.3 billion in assets remains unfrozen. By his estimate, if frozen stablecoins are eventually returned, Binance’s SAFU emergency fund, worth about $1.2 billion, could cover roughly a third of the remaining losses, with the exchange’s own funds covering the rest.
What matters now, Farrell said, is how fast Binance reopens withdrawals and whether money leaves the exchange in an orderly way. If customer assets came up short, Binance could be forced to sell reserves, and that could spread selling across crypto markets, he said.
“I do not think that is the setup we are dealing with,” Farrell said.
On Friday, bitcoin was trading below $78,000 and was under pressure, CNBC reported.
Chris Perkins, head of Franklin Crypto at Franklin Templeton, said the hack shows the industry needs stronger cybersecurity standards. Governments also need to coordinate more closely, he told CNBC’s “Squawk Box Asia.”
“We need to make sure standards are incredibly high, but we have to really focus on the criminals,” Perkins said. He wants more international cooperation and suggested the G20 as a model, since its members coordinated on regulation after the global financial crisis.
Binance has promised a detailed technical post-mortem when its investigation wraps up and the facts are fully verified. An updated Proof of Reserves will follow once remediation is done, the company said.
Have something to promote?
Bring your business, services or event to our readers.