Binance, the world's largest cryptocurrency exchange, confirmed Friday that hackers stole roughly $5.6 billion in digital assets, a haul that would stand as the largest cryptocurrency heist on record. The exchange suspended withdrawals while insisting user funds are safe and that it will cover all losses. Blockchain intelligence firm TRM Labs attributed the breach to TraderTraitor, a North Korean hacking unit also blamed for the $1.5 billion Bybit hack in February 2025.
The breach expanded beyond a single laptop
Binance said its initial investigation pointed to a compromised laptop but that subsequent work uncovered additional breach points, describing the attack as complex. The exchange said it is coordinating with law enforcement and will share details as they are established. Binance.US, the separate U.S. entity, was reportedly unaffected.
Stablecoin issuers freeze $2.4 billion on-chain
The stolen assets included $1.57 billion in Tether’s USDT, $1.45 billion in Bitcoin, $875 million in Ethereum, $823 million in Circle’s USDC, $234 million in Tron, $88.5 million in Ripple’s RLUSD, $75 million in Wrapped Beacon Ethereum, $50 million in Tether Gold, and $447.5 million in other tokens. Tether, Circle, and Ripple blacklisted the primary wallet address on their respective smart contracts, freezing roughly $2.4 billion in stablecoins. Tether Gold may also be subject to a freeze. The blacklists prevent the tokens from moving or being exchanged, but they do not constitute recovery; restitution typically requires court proceedings to establish ownership.
The remaining $3.2 billion has no central off-switch
Bitcoin, Ethereum, and the other non-custodial assets lack a central issuer capable of freezing funds. Some blockchains incorporate clawback mechanisms, but the prevailing outcome in past heists has been permanent loss. Exchanges may block deposits from the flagged addresses when the attacker attempts to cash out, though that has historically proven an unreliable recovery method.
Attribution rests on on-chain forensics
TRM Labs said its assessment relied on robust on-chain and off-chain intelligence, noting the operation bears the hallmarks of previous TraderTraitor activity. An analyst at Pangolin Intelligence corroborated the link after correlating on-chain flows with known North Korean infrastructure. Neither firm disclosed the specific technical indicators.