Binance Seeks to Reclaim $6.3bn Stolen in North Korean-Linked Hack
The world's largest crypto exchange has frozen half of the assets taken in a record cyber-heist and is working with U.S. law-enforcement to trace the missing funds.
Binance announced that it has secured roughly $3bn of the $6.3bn (about £4.7bn) in digital assets that were siphoned during a sophisticated hack that is believed to be the largest theft in cryptocurrency history. The exchange said it has frozen about half of the stolen holdings, but the remaining funds remain in the possession of unidentified hackers.
The company’s initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which would have allowed unauthorized withdrawals. Subsequent analysis revealed a wider breach, with attackers employing a self-destruct mechanism that erased tooling and logs as they moved through the system. Binance’s co-CEO Richard Teng said the incident involved multiple points of compromise and that the attackers deliberately destroyed evidence to impede recovery.
U.S. authorities are actively involved in the effort to trace and recover the missing assets. The Secret Service has stated that it is working around the clock to identify, freeze, and recover the stolen funds, while the FBI is collaborating with Binance on the investigation. Although Binance’s U.S.-facing platform was reportedly unaffected, U.S. jurisdiction remains relevant for tracking the flow of the stolen assets, which include U.S.-linked stablecoins such as Tether and Circle.
Binance has reassured its users that their money is safe and that the company will cover any losses. The exchange initially halted all deposits and withdrawals, then clarified that deposits remained unaffected. It has also set aside more than $6.34bn in company reserves to cover the stolen assets and is actively purchasing a range of crypto tokens to rebuild its balance sheet.
The hack sent ripples through the broader market. Bitcoin fell 5% to $76,800 in New York trading on the day of the announcement. Coinbase shares dropped 12% amid earnings that fell short of expectations, while Robinhood fell 7.8% as investors reacted to the broader uncertainty in the crypto space.
Analysts have linked the attack to a North Korean hacking unit, a claim supported by Chainalysis and TRM Labs, which noted similarities to the 2025 Bybit heist and other incidents attributed to the Lazarus Group. North Korea’s use of cybercrime to generate revenue is well documented, and the regime has repeatedly denied involvement, despite extensive evidence from cryptocurrency flow analysis and insider testimony.
The incident raises questions about the enforceability of Binance’s promise to cover losses. Legal experts caution that recovery may depend on the contractual terms users agreed to and that customers may need to pursue litigation to obtain compensation. Binance has faced regulatory scrutiny worldwide, and the current breach could intensify calls for stricter oversight of custody and security practices in the crypto industry.
For founders, operators, and investors, the Binance hack underscores the importance of robust security protocols, diversified custody solutions, and clear legal frameworks for dispute resolution. The industry must balance the allure of rapid growth with the need for resilience against sophisticated state-backed adversaries. As investigations continue, the crypto community will watch closely to see whether Binance can fully recover the stolen assets and whether the sector can implement lessons that prevent a repeat of this unprecedented breach.