Crypto giant Binance attempting to recover $6.3bn stolen in hack linked to North Korea

Binance suffered a massive security breach in which hackers accessed $6.3bn in digital assets. The incident matters because it is believed to be the largest cryptocurrency heist described in the article, surpassing the $1.5bn Bybit theft in 2025.

Binance first suspected that a DevOps engineer’s laptop had been compromised. That may have enabled unauthorised withdrawals, but the company later found additional points of breach. Co-CEO Richard Teng said the attack was not carried out by one person. The hackers also used a self-destruct mechanism that erased tools and traces as they operated.

The full access route remains unclear. Binance has frozen or secured about $3bn, but unidentified hackers still hold some assets. The FBI, the US Secret Service, Binance, and international partners are working to trace the funds and identify those responsible. Several analytics firms link the incident to North Korea.

The hackers accessed approximately $6.3bn in stolen digital assets. That figure makes the incident larger than the $1.5bn Bybit exchange heist in 2025, which the article identifies as the previous comparison. The scale has raised major questions about Binance’s ability to absorb the loss.

Binance says it has secured about $3bn of the stolen assets. This is roughly half of the total, although the article uses both “frozen” and “secured” when describing the recovered funds. The remaining assets were still in the hands of unidentified hackers when the report was published.

The recovery effort is continuing. The US Secret Service said it was working to identify, freeze, trace, and recover the funds. Binance is also working with the FBI. The company has promised users that customer money is safe and that it will cover every loss, though legal experts question whether that promise is legally binding.

A cryptocurrency exchange is a digital marketplace that lets users buy, sell, and trade cryptocurrencies. Binance performs that role and also holds assets in custody for customers. This matters because a successful attack on exchange systems can affect many users and concentrate enormous value in one target.

The article says Binance allows users to trade digital assets and had more than 300 million registered users worldwide. It also reported more than $160bn in assets under custody in 2024. In practice, customers leave assets with an exchange so they can trade conveniently, rather than managing every transaction themselves.

That concentration explains the scale of the reported loss and the fear among customers. The article says Binance’s US-facing exchange was unaffected, and Binance told users their money was safe. However, experts warned that promises to cover losses might not be legally binding and could depend on customer contracts and where Binance can be sued.

The suspected perpetrators are North Korea-linked cybercriminals. Several analytics firms connected the Binance attack to a North Korean hacking unit, while Chainalysis said it had “high confidence” that a North Korean was linked to it. The accusation matters because North Korean-linked groups have been blamed for many major cryptocurrency thefts.

The article names the Lazarus Group, also known as TraderTraitor, as a cluster of cybercriminals accused of working directly for the North Korean regime. TRM Labs said the Binance attack resembled earlier North Korean-linked incidents, including the Bybit hack. Investigators have also pointed to cryptocurrency flow analysis and interviews with defectors.

North Korea denies the accusations. However, the article describes the country as impoverished, heavily sanctioned, and having little industry. Experts say the regime uses cybercrime to bring money in. The investigation is still developing, and the article does not identify an individual attacker or provide proof of a final criminal finding.

Cryptocurrency can often be traced because transactions are recorded on public blockchains and linked to wallet addresses. Investigators and analytics firms follow the movement of stolen assets, identify services where funds arrive, and share evidence with exchanges and law enforcement. This matters because digital theft does not necessarily make money permanently invisible.

Exchanges can suspend withdrawals or freeze accounts that receive identified stolen funds. Stablecoin issuers such as Tether and Circle may also be able to block or freeze tokens under their control, depending on their policies and the specific asset. The article says the hack involved US-linked stablecoins from both companies, but it does not describe their individual actions.

The US Secret Service said it was working to identify, freeze, trace, and recover the funds. Binance is working with the FBI, and recovery generally requires global law-enforcement cooperation. Recovery remains difficult when hackers move assets through multiple wallets or services, or keep them outside cooperating platforms.

If Binance cannot cover the losses, customers could lose access to some or all of the affected assets. The consequences would depend on customer contracts, Binance’s finances, and any legal proceedings. This matters because Binance is one of the world’s largest exchanges and holds more than $160bn in customer assets, according to its 2024 figure.

The company has repeatedly said customer funds will be covered and that it is strong enough to survive the crisis. However, legal experts warned that customers should not treat this promise as legally binding. Daniel Tunkel said the outcome would depend on what customers were promised and where Binance could be sued for non-performance.

A failure to cover losses could damage confidence across the crypto industry. The article notes that users compare Binance’s assurances with statements made by FTX chief Sam Bankman-Fried before FTX collapsed in 2022. It does not predict a Binance collapse, but says customers and observers are worried.

A blockchain is a shared digital ledger that records cryptocurrency transactions in a linked history. New transactions are checked and added to that record, creating a durable trail between wallet addresses. This matters because stolen cryptocurrency can often be followed even after hackers move it.

For example, investigators can watch funds leave a compromised wallet, map transfers between addresses, and identify when coins reach an exchange or other service. Analytics firms use this kind of transaction analysis. The article says Chainalysis linked the Binance hack to a North Korean actor with high confidence, while the US Secret Service is tracing and freezing funds.

The trail does not automatically reveal a person’s real identity. Hackers can use many wallets and services, and recovery may require cooperation from exchanges, token issuers, and international authorities. The article supports the tracing effort but does not explain blockchain technology in detail; these ledger principles are established background knowledge.