Blockchain analysis firms say they have worked with Binance to freeze roughly half of the stolen money, and the exchange said it would cover all losses.
Hackers whom researchers have linked to North Korea stole roughly $6.3 billion in cryptocurrency from Binance, in the largest such theft in history, the exchange said on Thursday.
The attackers compromised several systems, including a Binance engineer’s laptop, before accessing a privileged system that allowed them to make the massive withdrawals, the companysaid in multiplesocial media posts.
“We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far,” Binance added. It promised to cover all of the losses.
Binance has suspended withdrawals and deposits while it investigates the theft. The company said it was working with law enforcement on the investigation, and both the FBI and the U.S. Secret Service confirmed their involvement to Cybersecurity Dive.
TheFBI said in a statement that it was “aware of the incident” and was “engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps.”
Tom Lynch, a spokesperson for the Secret Service’s Washington Field Office, said investigators from the agency “are working around the clock” with partners “to identify, freeze, trace, and recover” the funds stolen in the attack. Lynch said the agency is also coordinating with federal prosecutors “to identify the cyber criminals responsible and bring them to justice.”
The elite North Korean hacking team TraderTraitor was responsible for the Binance intrusion, according to cryptocurrency analysis firmsTRM LabsandChainalysis.
“Several features of this attack match earlier North Korea-linked heists,” TRM Labs researchers wrote in a blog post, “including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst.”
The hackers began laying the groundwork at least 36 hours before the thefts began which described several test runs that involved moving money between hacker-controlled wallets
It took roughly 20 minutes for the attackers to steal most of the money, TRM Labs said.
A coalition of blockchain analysis companies and other cryptocurrency firms worked together to trace and freeze roughly half of the stolen money, which “shows an industry increasingly able to act quickly, both independently and together,” Chainalysis researchers wrote.
North Korea has along historyofstealing cryptocurrencytofund its weapons programs. TRM Labs said in April that two groups linked to Pyongyang were responsible forthree-quarters of all cryptocurrency hack lossesin the first quarter of 2026. Chainalysis said last December thatNorth Korea stole $2 billion in cryptocurrencyin 2025, roughly 50% more than its 2024 total.
Until the Binance hack, the largest cryptocurrency theft on record was North Korea’s$1.5 billion breach of the ByBit exchange.
Editor’s note: This story has been updated with additional comments.
Filed Under:Breaches,Cyberattacks
