Binance freezes assets after massive theft

Binance, the world's largest cryptocurrency exchange, halted user withdrawals on Friday after an attack drained over $6 billion from its wallets. The company stated it is beginning to return affected assets to customers and will cover all financial losses.

The exchange told users on X that deposits remain unaffected. Withdrawals are expected to resume within the next day or two. Binance said an initial review suggested a compromised laptop was the entry point, but a deeper probe found multiple additional breach locations.

TRM, a U.S. blockchain intelligence firm, attributed the attack to TraderTraitor on Thursday. The firm described the group as North Korea's elite hacking unit and stated it made the judgment with high confidence. TRM reported that the attacker moved approximately $6.36 billion across ten blockchains, completing most of the transfer in about 20 minutes.

Chainalysis, another analysis firm, reached a similar conclusion. CEO Jonathan Levin wrote on X that the hack was likely executed by the North Korean group known as TraderTraitor. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identities of the criminals and bring them to justice.

This incident follows a similar breach at Bybit in February 2025, where hackers stole $1.5 billion. The FBI linked that theft to North Korean operatives. TRM noted that several features of the Binance attack match the patterns seen in the Bybit heist.

Kok Tin Gan, co-founder of cybersecurity firm NyxLab, said the breach appears to stem from a single signature that granted an attacker a full-access token to a hot wallet. He explained that hot wallets hold the private keys connected to the internet. Binance stated it found no evidence of a private key leak and will release more technical details when its investigation concludes.

Changpeng Zhao, who founded Binance in 2017, posted on X on Thursday that user funds are safe. Zhao, who pleaded guilty to a felony in 2023 and received a presidential pardon in 2025, said he expects all user funds to be fully covered as a shareholder.