Binance races to recover $6.3 billion stolen in largest crypto hack on record

Binance, the world’s largest cryptocurrency exchange, lost $6.3 billion to hackers in the largest crypto hack on record, with the North Korea-linked TraderTraitor group blamed by blockchain analytics firms TRM Labs, Chainalysis, and Elliptic.

About $3 billion of the stolen cryptocurrency has been frozen so far, but Elliptic says roughly $3.3 billion has already been converted into digital assets that cannot be frozen, creating a race between investigators and hackers to control the remaining funds. Binance says user funds are safe and that it will cover all losses, and the exchange is working with law enforcement on the investigation.

How the breach unfolded

The breach began late on Thursday, when a compromised engineer’s laptop gave an attacker access to a service container and allowed unauthorized withdrawal transactions to be submitted, according to Binance. The hot wallets connected to the internet were drained, and the entire theft took about 20 minutes, per TRM Labs. More than $2.5 billion was taken in one transaction alone. Binance later said additional points of breach were discovered beyond the initial laptop compromise, though the company said it found no evidence of a private key leak. Binance did not respond to questions about security audits of its network and systems prior to the hack.

Richard Teng, Binance’s co-CEO, said the attack was not carried out by one person. He described a self-destruct mechanism that destroyed tooling and traces as the hackers moved, making it more difficult for Binance to trace and investigate the incident.

A novel laundering trail

The hackers used novel laundering patterns not seen before, according to Chainalysis. Rather than simply moving funds onward, the attackers repeatedly circulated them among addresses, often sending funds back to addresses involved earlier in the sequence. Jonathan Levin, CEO of Chainalysis, said hackers moved a lot of money to different Tron addresses. According to TRM Labs, the hackers quickly sold USDT to market makers and borrowed ether against the stablecoin, which is harder to freeze than stablecoins pegged to the dollar. Stablecoin issuers Circle and Tether moved to freeze stolen funds after the hack, but the attackers had anticipated stablecoin freezing and got out ahead of it, said Joe Hancock, a partner at law firm Mishcon de Reya. Hackers are increasingly using Chinese money laundering organizations to convert crypto into fiat, according to Chainalysis and TRM Labs.

Ari Redbord, global head of policy at TRM Labs, described a race against time as hackers try to off-ramp crypto to fiat currency. Jonathan Levin said seizure opportunities diminish over time, and Phil Larratt, a senior director at Chainalysis, said the process takes weeks, months, if not years.

Attribution to Pyongyang

TraderTraitor emerged from Lazarus Group, which operates from North Korea’s Reconnaissance General Bureau, a military intelligence agency. Chainalysis said it had high confidence that a North Korean actor is linked to the hack, TRM Labs said elements of the attack resembled earlier North Korean incidents, and Elliptic attributed the attack to North Korean hackers. Some of the stolen funds have been traced to a wallet used in a previous cyberattack on crypto exchange Bitget earlier this year, in which $351 million was stolen. North Korea has denied involvement in cyber crime. Rafe Pilling, senior director of threat intelligence at Sophos, said crypto is less regulated and easier to move, making it a more enticing target for North Korea. Peter Ward of the Sejong Institute in Seoul said North Korea offers near-total protection to its hackers, and that things may get a lot worse going forward.

Customer protections and Binance’s pledge

Binance pledged to cover losses using its Secure Asset Fund for Users. The company said it had already reserved over $6.34 billion in company funds, with $5 billion already held in the exact token assets that were impacted. Binance said it is actively buying more tokens to cover the remaining amount, noting that some tokens may have low liquidity and settlement takes time. Binance said it will publish an updated proof of reserves once remediation is complete. Spokesperson Andie Cooper said Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms, and industry partners. Crypto users are not covered by formal deposit protections in the US, UK, or Australia. Customers of regulated banks get capped refunds — $250,000 in the US and £120,000 in the UK. Daniel Tunkel of the London-based Edwin Coe law firm said whether customers can recover losses will come down to what they were promised in their contracts and where Binance can be sued for non-performance.

The hack eclipses the previous largest crypto hack, a $1.5 billion theft from the Bybit exchange in 2025, which was also attributed to North Korea. Elliptic says this could be the biggest heist of any kind in history. Tom Robinson, chief scientist at Elliptic, said the previous record was held by Saddam Hussein, who took $1 billion from the central bank of Iraq in 2003. “This incident is almost certainly the single largest known theft of any kind,” Robinson said. Binance was founded in 2017 and has 300 million registered users. In 2023, the company pleaded guilty to US anti-money laundering charges and paid a $4.3 billion fine. Binance carries out about $95 billion in trades daily.