Suspected North Korean hackers steal $5.6 billion in crypto in record-breaking cryptocurrency heist, Binance withdrawals frozen

Binance, described as the world’s largest cryptocurrency exchange, suffered a theft involving about $5.6 billion in digital assets. The attackers drained the Binance 14, Binance 16, and Hot Wallet 34 wallets, which held pooled customer funds. The breach is still under investigation, so the final total could change.

Withdrawals were temporarily suspended because Binance needed to sort out the incident and determine how its systems were compromised. The company first suspected a compromised laptop, then reported additional breach points. It has not established whether attackers stole private keys, compromised the signing process, or used another intrusion method.

Binance repeatedly said user funds remained safe and promised to cover all losses. Its U.S.-specific Binance.us website was reportedly unaffected. The suspension gives the exchange time to coordinate with law enforcement, examine the stolen assets, and prevent further movement while it gathers facts.

A cryptocurrency hot wallet is a wallet kept connected to systems that can sign and broadcast transactions. That makes it useful for processing withdrawals and trading, but its connection also creates an attack surface. The article identifies Binance’s affected wallets as hot wallets holding pooled customer funds.

The reported theft shows the danger of concentration. Attackers drained Binance 14, Binance 16, and Hot Wallet 34 instead of targeting individual customers one by one. If attackers obtain private keys or compromise the signing process, they may be able to authorize transfers from a wallet containing assets belonging to many users.

The risk is not proof that hot wallets are inherently unsafe. Exchanges need them for fast transactions, but a breach can have a much larger impact when assets are pooled. Binance has not said exactly how these wallets were compromised. Its investigation is examining several possible intrusion methods.

The preliminary estimate puts the theft at about $5.6 billion across many cryptocurrencies. The largest listed amounts were $1.57 billion in USDT, $1.45 billion in Bitcoin, $875 million in Ethereum, and $823 million in USDC. The tally also included TRX, RLUSD, WBETH, XAUT, and other cryptocurrencies.

Stablecoin issuers moved quickly to blacklist the thief’s main wallet in their smart contracts. That action froze approximately $2.4 billion in USDT, USDC, and RLUSD. The frozen tokens cannot be moved or exchanged from that wallet, although the article says XAUT might also be frozen.

Freezing is not the same as recovery. The article says the frozen assets remain in place until complainants provide proof of ownership, usually through lengthy court processes. The figures are preliminary, and Binance’s final loss total may change as investigators learn more about the attack.

The frozen assets are unusable, but they are not automatically recovered. Tether, Circle, and other stablecoin issuers blacklisted the thief’s main wallet through their smart contracts. The tokens cannot be moved or exchanged there, and restitution usually requires complainants to prove ownership, often through courts.

The article contrasts this with Bitcoin and Ethereum. These cryptocurrencies have no governing entity that can simply freeze or reverse a transaction. The estimated $3.2 billion in non-stablecoin assets therefore may be permanently inaccessible or lost, although some networks have clawback mechanisms.

Exchanges could still block the thief if the stolen assets reach a platform for cashing out. However, the article says this has not historically been a reliable recovery method. The outcome depends on tracing the funds, identifying ownership, and whether any network or intermediary can intervene before the assets disappear.

Security firms suspect North Korea’s TraderTraitor unit because the attack resembles earlier incidents attributed to the same group. TRM said it based its assessment on robust on-chain and off-chain intelligence. The attribution is presented as a conclusion from evidence, not as a confirmed public finding by Binance.

TRM noted that TraderTraitor was previously named responsible for the $1.5 billion Bybit hack in 2025. According to the firm, the latest theft shares many hallmarks with earlier North Korean cryptocurrency heists. CNN also reported that an unnamed Pangolin Intelligence analyst reached the same conclusion after analyzing the stolen funds’ blockchain activity.

The investigation remains active. Binance said it is still gathering facts and coordinating with law enforcement. The suspected attribution could change as more evidence emerges, but the reported pattern of transactions and similarities to previous cases currently support the North Korea theory.

Binance says user funds remain safe and that it will cover all losses from the attack. The article describes the company as having insurance and a reasonable track record in similar situations, although it does not detail specific earlier Binance payouts. The promise matters because the stolen amount is far larger than the Bybit loss previously cited.

Binance created its Secure Asset Fund for Users, or SAFU, in 2018. The company deposits 10% of its trading fees into the reserve to cover losses caused by security issues. The article says the fund held 15,000 BTC, valued at about $1.17 billion when the story was published.

That reserve could help compensate users, but its stated value is below the reported $5.6 billion theft. Binance also said it would cover all losses, so SAFU may not be the only source of compensation. The fund’s value can change with Bitcoin’s price, and the investigation could alter the final tally.

Stablecoins in the article are issued tokens designed to represent dollars, such as USDT, USDC, and RLUSD. Their issuers control parts of the token contracts, including the ability to blacklist a wallet. That lets them stop their tokens from moving even though the transactions are recorded on a blockchain.

After the Binance theft, stablecoin issuers blacklisted the thief’s main wallet. This froze about $2.4 billion in USDT, USDC, and RLUSD. The tokens remained visible in the wallet, but the holder could not move or exchange them. The article says a similar freeze for gold-pegged XAUT was possible but not guaranteed.

Bitcoin and many other cryptocurrencies operate without a governing entity that can impose such a block. Their transactions generally cannot be reversed or confiscated by a central issuer. Some networks have clawback mechanisms, but the article says the remaining assets are most likely to be lost unless exchanges or other intermediaries stop a later cash-out.