Binance crypto exchange suspends trades over North Korea-linked hack

Binance was hit by a massive suspected cyberattack that moved billions of dollars from its wallets. The exchange temporarily suspended deposits and withdrawals so it could investigate, secure its systems, and check whether more assets were at risk. The pause was a security measure, not an announcement that user funds had disappeared.

Binance said an attacker compromised a software infrastructure engineer’s laptop. The attacker then reached an internal service and submitted unauthorized withdrawals. Binance said it found no evidence that wallet private keys had leaked. The company also said it had located and frozen about $3 billion in affected assets.

Binance said user funds were safe and promised to cover all hacking losses. It did not confirm the suspected North Korean link, saying it was working with law enforcement. The remaining assets and the investigation’s final findings were still unclear in the article.

Blockchain analysts said approximately $6.36 billion moved out of Binance wallets across 10 blockchains. TRM called it the largest cryptocurrency theft on record. The speed and scale made the incident especially serious because stolen assets can be transferred repeatedly before investigators or issuers respond.

Binance said it had located and frozen about $3 billion in affected assets. Tether separately froze around $1.6 billion in USDT, while Circle froze about $800 million in USDC. These figures describe assets that could be blocked or recovered, not necessarily money returned to users.

Binance did not provide details about the remaining $3.3 billion. The exchange said it would cover all hacking losses and that user funds were safe. The final financial impact therefore remained dependent on the investigation, asset recovery, and Binance’s promised compensation.

Binance is a cryptocurrency exchange, meaning a platform where users can trade digital assets and move them into or out of accounts. The article describes Binance as the world’s largest cryptocurrency exchange. Its scale means a security incident can affect enormous sums and attract attention from companies, analysts, and law enforcement.

In this case, Binance’s wallets held assets connected to the platform. The suspected attacker gained access through an internal service after compromising an engineer’s laptop, then submitted unauthorized withdrawals. Binance said there was no evidence that wallet private keys had leaked. Deposits and withdrawals were paused while the exchange checked its systems and affected assets.

An exchange’s role also creates a central point for security controls and emergency action. Binance said it located and froze about $3 billion and would cover hacking losses. The incident highlights why exchanges must monitor access, protect infrastructure, and coordinate quickly with blockchain companies.

Analysts suspect TraderTraitor because the Binance attack shared several features with earlier North Korea-linked cryptocurrency heists. TRM, a US-based blockchain intelligence firm, attributed the incident to the group with high confidence. Chainalysis co-founder and CEO Jonathan Levin reached the same conclusion, though Binance itself did not confirm it.

TRM said attackers moved approximately $6.36 billion from Binance wallets across 10 blockchains, mostly within about 20 minutes. The firm said this pattern resembled the February 2025 attack on Bybit, which lost $1.5 billion. The FBI attributed that earlier attack to North Korea and TraderTraitor.

These similarities are evidence-based attribution, not a public admission by North Korea or Binance. Binance said it was working with law enforcement to identify the criminals. The investigation could strengthen or revise the analysts’ assessment as more transaction and technical evidence is examined.

Moving billions quickly is possible because cryptocurrency transfers are recorded on digital blockchains and can be submitted electronically at any time. An exchange or connected service may process many withdrawal instructions rapidly when an attacker gains the right access. This makes compromised software or internal credentials especially dangerous.

The article says the attacker compromised an infrastructure engineer’s laptop, reached an internal service, and submitted unauthorized withdrawals. TRM reported that approximately $6.36 billion left Binance wallets across 10 blockchains, most of it within about 20 minutes. The article does not detail how each transaction was approved or routed.

In general, moving assets across several blockchains requires compatible destination addresses, transaction fees, and functioning network connections. Once transactions are accepted, recovery can be difficult, although issuers can sometimes freeze certain tokens. Binance’s investigation and cooperation with law enforcement were therefore important for tracing and blocking assets.

Companies such as Tether and Circle can freeze certain cryptocurrency units because they issue and manage those digital currencies. Their systems can mark specific token addresses as blocked, preventing the tokens from being transferred normally. This power applies to their own currencies, not every cryptocurrency on every blockchain.

After the Binance incident, Tether CEO Paolo Ardoino said Tether froze around $1.6 billion in USDT. Circle boss Jeremy Allaire said Circle froze about $800 million worth of USDC. These actions could stop suspected stolen tokens from moving through those currencies, even if other assets remained transferable.

Freezing tokens does not automatically recover every stolen asset. The article says Binance also located and froze about $3 billion, but it did not explain how all those assets were blocked. Recovery depends on identifying addresses, coordinating with issuers and investigators, and determining which transactions are connected to the theft.

Analysts say North Korea uses cryptocurrency theft and other illicit cyber activities to obtain foreign currency. The money can help fund the country’s nuclear program. International sanctions make it harder for North Korea to access ordinary international finance and trade, so stolen digital assets provide an alternative source of funds.

The Binance case illustrates the potential scale. Analysts said approximately $6.36 billion moved from wallets across 10 blockchains, and they linked the operation with high confidence to TraderTraitor. They also compared it with the $1.5 billion Bybit theft, which the FBI attributed to North Korea and the same group.

Binance did not confirm the attribution and said it was working with law enforcement. About $3 billion had been frozen, while the fate of roughly $3.3 billion was not provided. The case shows why exchanges, token issuers, and governments are tracking stolen cryptocurrency across borders.