Binance Freezes $3B, Suspends Withdrawals After $6.36B Hack

Binance users cannot withdraw funds right now. The exchange suspended withdrawals on Friday after about $6.36 billion left its wallets, and said deposits were unaffected. Binance expects withdrawals to resume within a day or two and said it will cover all losses. It froze roughly $3 billion in affected assets with blockchain partners.

TRM, a U.S.-based blockchain intelligence firm, posted on its website Thursday that the theft was the largest cryptocurrency heist on record. The firm attributed the attack to TraderTraitor, which it describes as North Korea's elite hacking unit, and said it made the judgment "with high confidence." TRM said the money moved across ten blockchains, with most of it transferred in about 20 minutes. Chainalysis reached a similar conclusion; co-founder and CEO Jonathan Levin wrote on X that the incident was "likely done by DPRK group TraderTraitor."

Binance told users on X Friday that its initial investigation suggested a compromised laptop, but a later review found additional "points of breach." The company said it had found no evidence of a wallet private key leak and will publish technical details when its probe ends. Binance spokesperson said the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."

North Korea's record in this area stretches back years. The FBI said North Korea and TraderTraitor were responsible for a $1.5 billion hit on the Bybit exchange in February last year, and TRM said features of the Binance attack match that case. In December 2022, South Korea's spy agency estimated that North Korean hackers had stolen $1.1 billion in cryptocurrency over five years, with more than half of that taken in 2022 alone. Experts say the country pursues these thefts to obtain foreign currency for its economy and nuclear program under U.N. sanctions.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, questioned the approval controls behind the breach. "This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said, referring to wallets connected to the internet that hold users' private keys.

Changpeng Zhao, who founded Binance in 2017 and left the CEO post in 2023 after pleading guilty to a felony linked to money laundering controls, posted on X Thursday. "User funds are safe!" he wrote, while adding the theft "does look like a hack on Binance." Zhao, pardoned by President Donald Trump in 2025, said that as a shareholder he expects all user funds to be fully covered. Binance said it will release more technical details when its investigation is complete.