Live updates: Binance $6.3B hack linked to North Korea’s TraderTraitor

The Binance incident was a major cryptocurrency theft. Binance estimated the total impact at about $6.3 billion. Its initial investigation pointed to a compromised DevOps engineer’s laptop, which may have given attackers access to an internal service container. The breach matters because it affected a major centralized exchange and forced a temporary withdrawal pause.

The suspected mechanism involved unauthorized withdrawal transactions. Binance said attackers may have used the compromised computer to access a service container and submit those transactions. The exchange also described a customer sweeper contract and multiple authorizations. It said there was no evidence of a wallet private-key leak, although the investigation was still continuing.

Binance was tracing the full attack path and revamping its withdrawal service and related addresses. Deposits continued operating normally, while withdrawals were expected to resume within 48 hours. Industry partners had frozen about $3 billion, but investigators warned that the total impact could change as they traced more assets.

Binance estimated that the attack affected about $6.3 billion in cryptocurrency. That figure describes the total impact reported by the exchange, not necessarily money permanently lost. Chainalysis co-founder Jonathan Levin put the theft slightly higher, at $6.4 billion, showing that estimates were still developing.

By the time of the update, industry partners had frozen about $3 billion in stolen assets. The frozen cryptocurrencies included USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP and ARB. First Digital separately confirmed that it had frozen FDUSD involved in the attack.

The figures remained provisional. Binance said the verified total value of frozen cryptocurrency was $3 billion, and that amount could rise as investigators traced additional assets. Chainalysis and other analysts continued monitoring the funds, while Binance worked to secure its withdrawal service and related addresses.

TraderTraitor is a hacking group that the FBI has named as responsible for the ByBit hack in February last year. Investigators link the group to North Korea, also called the DPRK. In this incident, TRM Labs attributed the Binance attack to TraderTraitor with high confidence, based on onchain and off-chain intelligence.

The clues included stolen funds from the Binance attack and an earlier Bitget exploit appearing in the same address after moving through THORChain. ZachXBT said this suggested that one actor was behind both incidents. The Bitget exploit had already been attributed to DPRK-linked TraderTraitor and overlapped with earlier exploits, including Kelp DAO.

Other analysts saw similar patterns. Blockaid described sophisticated onchain preparations, a customer sweeper contract and multiple authorizations. Chainalysis also cited links to a previous hack. These are analyst assessments, not a completed public finding, and Binance’s investigation into the attack path was still ongoing.

The attack disrupted Binance withdrawals but not deposits. Binance said deposits were operating normally while withdrawals remained paused. The pause allowed its security team to revamp the withdrawal service and related addresses and investigate the suspected entry point.

The exchange expected withdrawals to resume within 48 hours. Binance said the incident involved multiple factors and that a compromised computer was suspected as the entry point. While the investigation continued, analysts tracked stolen assets and partners froze cryptocurrency across several tokens.

Markets also weakened after the attack. Bitcoin traded near $76,937, down 4.9% over 24 hours. BNB fell 8% to about $693, while Ether declined 5.7% to about $2,211. DeFi tokens also dropped, including AAVE by 11.3% and Uniswap’s UNI by 10.7%, although the article does not establish that the hack directly caused every price move.

Freezing stolen cryptocurrency usually depends on the design of the token or network. Some stablecoin issuers can place specific addresses on a blacklist, preventing their tokens from moving. A blockchain governance body, such as a security council, may also be able to pause or restrict certain contracts. These capabilities are not available for every cryptocurrency.

The article reports that industry partners froze assets including USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP and ARB. First Digital separately confirmed that it froze FDUSD involved in the attack. These examples show coordinated action across issuers and crypto projects.

The article does not identify the exact freeze mechanism used by each organization. In general, a freeze can stop transfers from known addresses, but it does not erase the transaction history or automatically recover funds. Investigators must first identify addresses and keep monitoring new movements as stolen assets are routed through other services.

Centralized exchanges hold and manage trading infrastructure for customers. A serious breach can therefore interrupt withdrawals and undermine confidence in one company’s security. Decentralized exchanges, or DEXs, may appear attractive because trading occurs through blockchain-based smart contracts rather than one central exchange operator.

Standard Chartered’s Geoffrey Kendrick said the Binance hack could push more trading toward DEXs and benefit Uniswap over the longer term. He retained a $100 price target for UNI by 2030 and encouraged investors to re-engage with Uniswap. The article also reports that Uniswap had never had any exploits, according to Kendrick.

The shift is not certain. CoinGecko data showed the top 10 spot DEX-to-CEX ratio reached 23.5% in the second quarter of 2026, up 2.1 percentage points from the first quarter. The breach could strengthen that trend, but the article does not say that traders had already moved because of this incident.

A blockchain is a shared digital record of cryptocurrency transactions. It lets participants verify which addresses sent and received assets. A crypto wallet is software or hardware that manages the information needed to use those assets. The assets remain recorded on the blockchain rather than sitting inside the wallet itself.

A private key is a secret credential that proves control over a wallet address. When someone sends cryptocurrency, the wallet uses the private key to create a digital signature. The network checks that signature before accepting the transfer. If the key is exposed, an attacker can generally authorize transactions from that address.

The Binance incident may have used a different route. Binance said a compromised DevOps engineer’s laptop may have let attackers access a service container and submit unauthorized withdrawal transactions. It also said there was no evidence of a private-key leak, while warning that the investigation remained ongoing.