According to Binance, the initial investigation identified a compromised laptop belonging to a DevOps engineer as the entry point. This allowed an attacker to access a service container and submit unauthorized withdrawal requests. However, Binance co-CEO Richard Teng clarified that the attack was not a simple “one-click” action utilizing a single engineer’s permissions, but rather a “complex attack process” involving multiple points of breach. The company stated that user funds remain safe within the platform and has committed to covering all losses resulting from the incident.
To mitigate the damage, Binance activated its emergency reserve fund, which holds approximately $1.3 billion, and reserved an additional $6.34 billion in company funds. Of this reserved amount, $5 billion is held in the exact token assets that were targeted, allowing for direct compensation. As of the latest updates, roughly $3 billion of the stolen assets have been frozen on-chain through coordination with blockchain partners. Major stablecoin providers, including Tether and Circle, also froze associated funds; Circle CEO Jeremy Allaire confirmed that more than $800 million in currency was frozen in coordination with law enforcement.
Independent blockchain intelligence firms have linked the attack to North Korea. TRM Labs, a U.S.-based firm, attributed the hack to “TraderTraitor,” a unit it describes as North Korea’s elite hacking group. TRM stated with “high confidence” that an attacker moved approximately $6.36 billion out of Binance wallets in about 20 minutes. The firm noted that several features of the attack, including the speed and scale, matched earlier North Korea-linked heists, such as the $1.5 billion hack on the Bybit exchange in February 2025. Chainalysis, another leading blockchain analysis company, also expressed the view that the hack was “likely done by DPRK group TraderTraitor.”
Experts suggest that North Korea has increasingly turned to cryptocurrency theft as a primary source of foreign currency to support its economy and fund its nuclear program, particularly under the strain of U.N. sanctions. Following the December 2022 report by South Korea’s spy agency that North Korean hackers had stolen an estimated $1.1 billion, the consistent attribution of these high-profile hacks to DPRK-linked groups underscores a significant geopolitical dimension to crypto security. A Binance spokesperson said the company is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice, though no individual responsibility has been officially attributed at this stage.
The incident has triggered immediate operational changes at the exchange. Deposits and withdrawals were temporarily suspended to allow security teams to conduct checks and freeze funds. By Friday, Binance announced it was beginning to recover assets for users and expected withdrawals to resume within a day or two. The company emphasized that it has found no evidence of a leak of wallet private keys, which are the cryptographic credentials required to access funds in a decentralized system.
The scale of the breach has also drawn unusual attention from outside the security sector. Elon Musk, the CEO of SpaceX and Tesla, posted a series of emojis on X reacting to the news. In response, Binance co-founder Changpeng Zhao publicly asked Musk to “show some support” rather than “troll” the company. Zhao noted that Binance holds an equity stake in SpaceX, valued at more than $1 billion, stemming from an earlier investment in what was then-Twitter. He stated, “Elon, have a lot of respect for you, but bad time to troll. Please stop.” This exchange highlights the complex interplay between major tech figures and the crypto industry during a crisis.
For the 335 million registered users of Binance, the incident raises critical questions about the security infrastructure of centralized exchanges. While Binance promises to cover the losses, the freezing of $3 billion in assets leaves a significant portion of the stolen funds unaccounted for. The recovery of the remaining $3.3 billion depends on the ability of blockchain intelligence firms to track and freeze assets before they are moved to less regulated exchanges or converted into fiat currency. Law enforcement agencies are now engaged in a race to trace the flow of funds, a process that can take weeks or months. The outcome of this case will likely influence future regulatory scrutiny of how large exchanges manage internal access controls and monitor for anomalous withdrawal patterns.
