Behind Largest Crypto Heist: Who Took $6.3bn From Binance?
Binance is investigating a record crypto theft after hackers moved billions of dollars from its wallets in about 20 minutes. TRM Labs and Chainalysis point to…
Binance said on Friday it was working to recover assets after a record $6.3 billion crypto heist, as blockchain analysts linked the attack to a North Korean hacking unit. The theft unfolded largely in about 20 minutes, and the exchange said customer funds were safe.
The suspected attack has raised questions about how hackers moved funds from Binance wallets and how much of the stolen cryptocurrency can still be recovered. Binance said it had located about $3 billion and would cover customer losses with company funds.
Who is behind the largest crypto heist?
The exact culprit has not been confirmed by Binance. TRM Labs said it assessed with high confidence that TraderTraitor, a North Korean hacking unit, carried out the attack; blockchain analysis firm Chainalysis reached the same conclusion.
TRM said the method resembled a 2025 heist at crypto exchange Bybit, which the FBI attributed to North Korea. Analysts said attackers manipulated Binance’s virtual wallets, directing funds into wallets they controlled before moving the assets onward.
Binance has taken a more cautious position. Co-CEO Richard Teng said the company’s investigation had not attributed responsibility to any individual. Binance initially said a compromised laptop belonging to an engineer may have provided access to one of its systems. The company later reported finding additional points of breach.
The US Cybersecurity and Infrastructure Security Agency warned in 2022 that TraderTraitor had targeted cryptocurrency companies since 2020. The agency said the group was likely to keep exploiting technology firms, gaming companies and exchanges to generate and launder funds for North Korea.
How much money has been recovered?
Binance said about $3 billion in affected assets had been located, while the exchange is working with law enforcement, issuers and industry partners to trace, freeze and recover more. It said it had frozen $4.2 billion of funds following the attack and had begun recovering affected assets for users.
TRM estimated about $3.4 billion worth of cryptocurrency remained out of reach. Roughly half of the stolen coins had been frozen by issuers, according to the company. The amounts reflect different estimates of assets located, frozen or still inaccessible as investigators track funds moving between destinations.
Chainalysis investigators traced stolen funds being laundered and shuffled through an automated process intended to obscure their trail. The firm said the investigation was ongoing and expected the funds to continue moving in the coming days.
Binance said it had set aside around $6.34 billion in company funds to cover losses. The exchange also operates a $1 billion bitcoin reserve fund intended to protect users in the event of a security breach, according to its website.
What does the breach mean for Binance customers?
For customers, the central question is whether the exchange can restore access to affected assets while keeping withdrawals and trading secure. Binance said it would cover losses and was working to recover funds, while the size of the remaining inaccessible amount makes the tracing effort a continuing part of the response.
Bitcoin and stablecoins were among the types of cryptocurrency stolen. Stablecoins are designed to maintain their value by being backed by a specified asset or collection of assets, according to the Bank of England. Other cryptocurrencies, including Bitcoin, are digital assets that can be bought, sold and transferred online, and their value can fluctuate.
The attack also highlights how a breach of a large exchange can involve more than one point of access. Binance said its initial investigation focused on a compromised engineer’s laptop, then uncovered additional breach points. The company said it had enough money to cover the incident and that much of its reserve was held in the same types of tokens that were stolen.
US blockchain analysis firms also connected the attack’s apparent wallet manipulation to the earlier Bybit case. That assessment remains distinct from Binance’s own position: the exchange has said it has not identified an individual responsible, while investigators continue tracing the funds.
Binance said it was working with law enforcement, cryptocurrency issuers, blockchain intelligence firms and industry partners to freeze and recover additional assets.
