Binance $6.3B Hack Linked to North Korea's TraderTraitor

Binance Reports $6.3 Billion in Assets Stolen in Major Hack; $3 Billion Frozen

Binance, the world’s largest cryptocurrency exchange, has reported a staggering $6.3 billion in assets stolen in a significant security breach. Approximately $3 billion of the illicitly obtained funds have since been frozen.

Suspected North Korean Involvement

Chainalysis co-founder and CEO Jonathan Levin suggested that the hack was likely orchestrated by the North Korean hacking group TraderTraitor, citing connections to previous exploits. Levin’s estimate of the theft reached $6.4 billion, slightly exceeding Binance’s initial assessment. He also confirmed that industry partners had frozen around $3 billion, with Chainalysis actively tracking the movement of the stolen funds.

On-chain investigator ZachXBT noted that funds stolen from both the Binance attack and an earlier Bitget exploit were commingled in the same address after passing through THORChain, indicating a single actor was likely responsible for both incidents. The Bitget exploit had previously been attributed to the DPRK-linked TraderTraitor, which has also been linked to other exploits like Kelp DAO.

Blockaid co-founder and CEO Ido Ben-Natan echoed these suspicions, telling Cointelegraph that the attack’s sophisticated on-chain preparations, customer sweeper contract, and multiple authorizations bore the hallmarks of North Korean state-sponsored activity. TRM Labs also attributed the attack to TraderTraitor with “high confidence,” citing robust on-chain and off-chain intelligence. The FBI has previously identified TraderTraitor as the group behind the ByBit hack in February of the previous year.

Security Revamp and Service Resumption

Binance announced that withdrawals would remain temporarily paused as the exchange undertakes a comprehensive security overhaul of its withdrawal service and associated addresses. Service is expected to resume within 48 hours, while deposits continue to operate normally. The exchange stated that the incident involved multiple factors and that its security team was meticulously tracing the attack’s full path, suspecting a compromised computer as the initial entry point.

Impact on Decentralized Exchanges

Geoffrey Kendrick, Standard Chartered’s global head of digital assets research, posited that the Binance hack could drive increased crypto trading towards decentralized exchanges (DEXs) and potentially benefit Uniswap in the long term. Kendrick maintained his $100 price target for Uniswap’s UNI token by 2030, suggesting the breach could make this forecast conservative. CoinGecko data indicates a growing trend of DEX-to-Centralized Exchange (CEX) trading volume. Kendrick encouraged investors to consider Uniswap, highlighting its history of no exploits and the potential for increased DEX adoption following the breach of a major CEX like Binance.

Initial Investigation Points to Compromised Laptop

Binance’s initial investigation into the multi-billion dollar breach pointed to a compromised DevOps engineer’s laptop as the likely vector. The exchange believes this compromise may have granted an attacker access to a service container, enabling the submission of unauthorized withdrawal transactions. While no evidence of a private key leak has been found, the investigation is ongoing. The total estimated impact of the hack was confirmed at $6.3 billion.

Frozen Stablecoins and Market Reaction

First Digital CEO Vincent Chok confirmed that FDUSD stolen in the attack on Binance had been frozen. He stated that First Digital was collaborating with the Binance team to protect FDUSD holders and prevent the movement of stolen funds.

The hack triggered a downturn in the crypto market. Bitcoin traded near $76,937, down 4.9% over 24 hours. BNB fell 8% to approximately $693, and Ether declined 5.7% to about $2,211. DeFi tokens also experienced losses, with AAVE down 11.3% and Uniswap’s UNI down 10.7%. The Bitcoin Fear and Greed Index dropped to a “fear” score of 30, a level not seen since August.

Arbitrum Freezes Funds

The Arbitrum Security Council announced it had executed a transaction to freeze $30.5 million from the Binance exploit, comprising 74.6 million Arbitrum (ARB) and 8,425 Ether (ETH). The council stated its commitment to the security and integrity of the Arbitrum community and governance, ensuring no impact on Arbitrum users or applications. The frozen funds were transferred to an intermediary wallet, inaccessible without further action from the Security Council or a vote by the Arbitrum DAO governance.

Chainalysis Estimates and Binance’s Frozen Assets

Chainalysis estimated the amount stolen from Binance at $5.912 billion at the time of the theft, four times the amount taken in the 2025 Bybit exchange hack. Binance had previously reported a verified total of $2.54 billion frozen.

Potential Transaction Signature Manipulation

Blockaid co-founder and CEO Ido Ben-Natan suggested that the Binance hack may have involved attackers manipulating the exchange’s transaction-signing signature. Ben-Natan explained that preliminary assessments pointed to “key misuse,” where attackers trick a signing system into authorizing malicious transactions without extracting private keys. He emphasized that this was a preliminary assessment based on observations of on-chain activity and experience with similar attacks. Arkham CEO Miguel Morel indicated that the attack appeared to be ongoing.

Deposits Suspended, Losses Covered

Binance temporarily suspended deposits to conduct security checks, freeze funds, and coordinate with law enforcement. Withdrawals had previously been confirmed as suspended. The company stated it was working around the clock and would provide a full post-mortem after the investigation, pledging to “cover all losses.” Binance Alpha trading was also temporarily suspended.

Exposure for Trading Firms

Crypto trading firms Wintermute and GSR disclosed exposure to Binance but did not anticipate significant business disruption. As market makers, their operations are crucial for facilitating transactions across crypto markets. GSR CEO Xin Song stated their Binance exposure was less than 5% of net equity, and Wintermute CEO Evgeny Gaevoy reported less than 20% exposure, with no expected operational disruption. Neither executive disclosed specific dollar amounts or confirmed financial losses.

Ripple Freezes Stablecoin Holdings

Ripple announced it was freezing holdings of its dollar-pegged RLUSD stablecoin linked to the Binance hack. Jack McDonald, Ripple’s senior vice president of stablecoins, confirmed that the company was “actively freezing affected funds” and cooperating with the investigation. The amount frozen was not disclosed.

World Liberty Financial Freezes Funds

World Liberty Financial froze $27 million in its US-dollar-pegged stablecoin USD1 and $2 million worth of WLFI, according to Binance co-founder Yi He. World Liberty Financial CEO Zach Witkoff stated the company had taken proactive steps to freeze the USD1 funds and worked with BitGo to freeze the stolen WLFI and USD1. The company pledged full cooperation with the investigation and emphasized user protection as a top priority.

Aave Freezes Markets

Decentralized lending protocol Aave froze markets across its V3 and V4 deployments as a precautionary measure following the Binance hack. Risk service provider LlamaRisk reported that the exploiter deposited 60 million USDT and borrowed 19,762 Wrapped Ether (WETH), valued at approximately $44.6 million at the time. This was the exploiter’s only Aave position, and no further interactions were detected after the borrowing period. The position remained collateralized by $59.9 million in USDT against a $43.8 million debt. The freezes prevented new deposits and borrowing, with markets expected to remain frozen until the exploiter’s funds stopped moving and Binance provided clarity on containment.

Initial Reports and Stablecoin Freezes

Initial reports of a potential multi-billion dollar security breach emerged when Binance began investigating suspicious transfers involving one of its Ethereum wallets. Stablecoin issuers Tether and Circle reportedly froze billions in assets. A Binance spokesperson confirmed the investigation into a potential security issue but stated no impact on user funds had been confirmed. Blockchain researcher Spreek first raised concerns, noting assets from a Binance-linked wallet transferred to a new address via a contract call allegedly funded by Tornado Cash. Arkham Intelligence identified wallets labeled “binance-hacker-1029” holding approximately $5.84 billion in digital assets.

Binance co-founder Changpeng Zhao confirmed the activity appeared to be a hack and that Tether and Circle had frozen approximately $971 million and $823 million, respectively, expressing confidence that all user funds would be covered. Blockaid identified roughly $3.3 billion in suspicious transfers across Ethereum, Arbitrum, and Avalanche.

Tether and Circle subsequently confirmed freezing a combined $2.36 billion in tokens. Circle CEO Jeremy Allaire stated that the company had frozen over $800 million in USDC in coordination with law enforcement. Tether CEO Paolo Ardoino announced the freezing of over $1.567 billion in USDT, emphasizing the priority of protecting the industry and partners.

The Binance hack occurred shortly after Polymarket temporarily halted trading due to a compromise at a third-party provider. The prediction market platform reported the issue was resolved and pledged to reimburse affected users.