Binance Confirms $6.3 Billion Security Incident, Pledges Full Loss Coverage as Investigators Point to North Korea

Binance said Friday that a security incident had an estimated impact of $6.3 billion, with roughly $3 billion in cryptocurrency assets frozen so far, and the exchange pledged to cover all customer losses, according to CNBC. Co-CEO Richard Teng said Binance would use its Secure Asset Fund for Users (SAFU) and company funds to make customers whole. Separately, blockchain intelligence firm TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, based on on-chain and off-chain intelligence, while Chainalysis said it assessed the hack was likely carried out by the same group, per CNBC's reporting. The FBI previously identified TraderTraitor as responsible for the $1.5 billion Bybit hack in February 2025, CNBC reported.

How the Breach Unfolded

Binance's initial investigation suggested the incident may have begun with a compromised DevOps engineer's laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions, the exchange said according to CNBC. Later in the day, Teng said the attack involved a more complex process rather than the misuse of a single engineer's permissions, and that the investigation had not attributed responsibility to any individual. Binance added there was no evidence of any wallet private key leak.

Binance temporarily suspended withdrawals while overhauling its withdrawal security systems and revoked the affected address authorizations, Teng said. Binance co-founder Yi He initially said deposits remained unaffected and continued operating normally, but the exchange later said it had also temporarily suspended deposits and withdrawals and had enlisted law enforcement and blockchain intelligence firms to trace and recover the stolen funds, per CNBC's account. Binance Alpha trading was also temporarily suspended, the exchange said on X, where it put the current verified total frozen at $2.54 billion, a figure distinct from the roughly $3 billion cited in its earlier statement.

Binance said it expects to begin resuming withdrawal services within the next 48 hours of its Friday statement, and that it would publish a technical report and an updated Proof of Reserves after remediation efforts, according to CNBC's reporting on the exchange's comments.

Stablecoin Issuers and Trackers Move to Freeze Funds

Circle CEO Jeremy Allaire said Thursday evening that the company had frozen more than $800 million in USD Coin associated with the incident, CNBC reported. Tether CEO Paolo Ardoino said on X that his firm had frozen more than $1.5 billion of USDT that may have been related to the breach. Yi He said Ripple, the XRP- and RLUSD-tied firm, helped halt the movement of $200 million in funds linked to the possible attack. Crypto data provider Arkham Intelligence linked nearly $6 billion in digital assets, including bitcoin, ether, solana and various stablecoins, to 55 wallet addresses it tied to the potential exploit, per CNBC.

TRM Labs estimated that approximately $6.36 billion in digital assets moved from Binance wallets across 10 blockchains, with most of the transfer completed within about 20 minutes, CNBC reported. The firm said preparations for the attack began at least 36 hours before the theft, with attackers using the Tornado Cash mixing service to fund their wallets ahead of the breach. Chainalysis co-founder and CEO Jonathan Levin said the firm assessed the hack was likely carried out by TraderTraitor, citing links to previous attacks.

Market Reaction

Bitcoin fell more than 4% to $77,994.96 on Friday as the hack weighed on crypto markets, CNBC reported. Shares of Circle tumbled about 5% in after-hours trading Thursday. Seeking Alpha similarly reported that crypto markets slid as Binance worked to probe the breach and aimed to resume withdrawals within 48 hours.

What Recovery Could Look Like

Freezing stolen crypto halts its movement, but recovering it requires a separate legal process, according to CNBC's reporting, which cited Redbord as explaining that law enforcement typically obtains a court order or seizure warrant before working with stablecoin issuers to release or reissue assets and return them to their rightful owners. Stablecoins such as USDT and USDC are considered the most recoverable category because issuers like Tether and Circle can freeze, burn and reissue tokens. Bitcoin and ether are harder to recover because neither has an issuer that can directly freeze the assets; recovery instead depends on tracing funds to an exchange willing to cooperate. Chainalysis's Eric Jardine said there is no standard recovery timeline, noting a technical freeze can happen quickly while returning funds to victims can take months or years, per CNBC.

Fundstrat's Sean Farrell told CNBC the attack does not currently appear to pose a significant solvency risk for Binance. He estimated around $3.3 billion in assets remained unfrozen, and said that if frozen stablecoins are eventually returned, Binance's roughly $1.2 billion SAFU fund could cover about a third of the remaining losses, with the rest coming from the exchange's own funds. This is Farrell's own estimate as reported by CNBC rather than a figure confirmed by Binance. Farrell said the indicators worth watching are how quickly Binance resumes withdrawals and whether outflows remain orderly, warning that a shortfall in customer assets could force the exchange to sell reserves and potentially trigger broader selling across crypto markets.

Franklin Templeton's Chris Perkins told CNBC the hack underscores the need for stronger cybersecurity standards and greater coordination among governments, pointing to regulatory coordination among G20 countries following the global financial crisis as a potential model. He also said artificial intelligence could help improve cybersecurity by identifying vulnerabilities, even as the technology is used by both attackers and defenders.

Exploits of this scale are not without precedent in the industry. Bybit suffered roughly $1.5 billion in losses in a 2025 hack, and Bitget lost more than $350 million worth of digital assets in a separate cyber theft incident, both cited by CNBC for context.

Bottom Line

Binance has confirmed a security incident with an estimated impact of $6.3 billion, pledged full coverage of customer losses through its SAFU fund and company reserves, and said it expects to begin resuming withdrawals within 48 hours of its Friday statement. Blockchain investigators at TRM Labs and Chainalysis have pointed to North Korea's TraderTraitor group as the likely actor, though Binance's own account of the technical root cause shifted over the course of its disclosures. Fundstrat's Sean Farrell told CNBC the attack does not currently appear to pose a significant solvency risk for the exchange; whether that assessment holds will depend largely on how smoothly withdrawals resume and whether frozen stablecoin balances are ultimately returned.