Binance Recovers Half of $6.3 Billion Stolen in Suspected North Korean Hack

Binance, the world's largest cryptocurrency exchange, has frozen approximately half of the $6.3 billion accessed in a sophisticated cyberattack, a figure believed to be the largest of its kind. The exchange stated that $3 billion of the stolen digital assets have been secured, though a significant portion remains in the hands of unidentified hackers.

Initially, the firm suspected a single engineer's laptop compromise might have enabled unauthorized withdrawals. However, investigations revealed a broader attack. Several analytics firms, including TRM Labs and Chainalysis, have linked the heist to North Korean hacking groups, citing similarities to previous attacks such as the Bybit exchange hack in 2025, which involved $1.5 billion.

The U.S. Secret Service has confirmed its involvement, stating it is working continuously to identify, freeze, trace, and recover the stolen funds, and to bring the perpetrators to justice. Binance has also confirmed its cooperation with the FBI.

Binance has assured its users that their funds are safe and that the exchange will cover all losses. The company temporarily suspended all deposits and withdrawals following the incident, but later updated that deposits remain unaffected. Founded in 2017, Binance serves an estimated 300 million registered users globally and held over $160 billion in assets under its custody as of 2024.

Concerns have been raised within the crypto industry about Binance's capacity to absorb such a substantial financial loss, with some observers drawing parallels to the collapse of FTX in 2022, which resulted in significant customer losses. Binance has consistently maintained its financial stability.

North Korea, an impoverished nation facing heavy international sanctions, is frequently accused by investigators of using cybercrime as a primary method for generating revenue. While the North Korean regime denies these allegations, evidence from cryptocurrency flow analysis and insider accounts from defectors has been considered compelling by experts, suggesting the nation may be unique in its use of hacking for state funding. The Lazarus Group, also known as TraderTraitor, is a cluster of cybercriminals often implicated in such activities and is believed to operate directly for the regime.