Binance sets aside $6.34 billion as analysts tie record hack to North Korea

Binance said on Friday that it has reserved more than $6.34 billion of company funds to make customers whole after attackers emptied hot wallets on several blockchains late Thursday, U.S. time. Blockchain analytics firms TRM Labs and Chainalysis separately linked the theft to TraderTraitor, a hacking unit tied to North Korea. Withdrawals remain suspended while Binance rebuilds parts of its withdrawal system, with the exchange pointing to a restart roughly two days after the pause began.

What happened

The overnight picture has sharpened since the first reports. Early estimates of the damage ranged widely, partly because some trackers counted the balances of wallets the attacker controlled rather than what had actually left Binance. The exchange now puts the total impact at about $6.3 billion. Chainalysis estimated $5.9 billion at the moment of the theft, and TRM Labs, whose figure was carried by the Associated Press, counted about $6.36 billion moved across ten chains. Most of it left in a burst of roughly 20 minutes. Even the lower estimates put the incident far above the $1.5 billion taken from Bybit in February 2025, which had been the record.

Binance's account of how it happened has also shifted. Its first explanation was a compromised laptop belonging to a DevOps engineer, which may have given the attacker a foothold inside an internal service that could submit withdrawal requests. Hours later the exchange said it had found additional points of breach and was working with law enforcement, without giving details. It has repeated that it has seen no sign that wallet private keys were leaked, which, if it holds, would mean the attacker got the system to sign transfers instead of stealing the keys outright.

The recovery plan came next. According to CoinDesk and a Binance statement carried by other outlets, about $5 billion of the $6.34 billion reserve is already held in the same tokens that were stolen. The rest is being bought on public markets and through over-the-counter desks so that the reserve matches losses token for token. Binance says customer assets are not being used, and that thinly traded tokens and OTC settlement may take longer. Its emergency fund for users, known as SAFU and historically holding around $1 billion in bitcoin, is part of the mix. The exchange says the outcome will be checked through its proof-of-reserves reports.

Separately, industry partners have frozen about $3 billion of the stolen assets, most of it in Tether's USDT and Circle's USDC. CoinDesk notes that this frozen pool is not counted in Binance's reserve, so any amount eventually returned would come on top of it. Deposits are working normally again. Withdrawals have been paused since early Friday, UTC, and Binance's most recent update said they were on course to resume in about 45 hours.

The attribution rests, for now, on private analysts. TRM said of its call: "We make this judgment with high confidence." Chainalysis chief executive Jonathan Levin wrote that the hack was likely the work of TraderTraitor. Independent investigator ZachXBT said some of the proceeds had been mixed at one address with funds from September's Bitget exploit, which had also been blamed on the group. The FBI has not commented on the Binance case. It did name TraderTraitor as responsible for the Bybit theft last year. Binance itself says its investigation has not yet attributed the attack to anyone.

Chainalysis also flagged laundering patterns it had not seen before, including thousands of rapid transfers that point to automated scripts, according to CoinDesk. Thin markets have already taken a hit: the FUN token lost about 90% of its value early Friday after the attacker sold a large amount. Bitcoin fell below $77,000 on Thursday before steadying, and ether and BNB dropped more sharply.

The debate

The first argument is about what Binance's promise is worth. A one-for-one reserve is a stronger commitment than the usual pledge to cover losses, and a much bigger number than SAFU alone. Market maker Wintermute's chief executive said on Thursday that Binance could absorb a far larger loss. Skeptics point out that the plan has not yet been tested by a full reopening of withdrawals, when customers can show through their own behavior how much they trust it. The proof-of-reserves update that Binance has promised will be the first hard evidence either way.

The second argument is over who should set security rules. OKX founder Star Xu called on exchange chiefs to treat safety as shared ground rather than a competitive edge. His proposals include instant settlement between verified exchanges, extra checks and short delays for large withdrawals to unknown addresses or smart-contract approvals, enforcement of those limits at the signing layer rather than in application code, and shared incident alerts with faster lawful freezes. Supporters see a chance for the industry to act before lawmakers do. Others note that voluntary standards have tended to fade once the headlines pass.

The third argument is about the freeze itself. Roughly half of the stolen value is locked because a few companies, mainly stablecoin issuers, can block tokens on request. Defenders call that proof that regulated dollar tokens protect users. Critics, including many in decentralized finance, see a single point of control that can be pointed at anyone. Both sides agree the hacker has been trying to swap frozen-risk assets into ones that cannot be blocked, which is why decentralized lending markets such as Aave froze their own pools on Thursday.

What it means

For U.S. policymakers, the timing is awkward. The CLARITY Act, which would have drawn a federal line between SEC and CFTC oversight of crypto markets, has stalled in the Senate, and Treasury Secretary Scott Bessent said this week the administration would work through the two agencies instead. A record theft at an offshore exchange whose founder, Changpeng Zhao, was pardoned by President Trump in 2025, is likely to feature in any renewed debate over custody standards, hot-wallet limits and incident reporting. For now, the response has come from private firms rather than regulators: analytics companies traced the funds, and stablecoin issuers did the freezing.

In Europe, the direct exposure is smaller than it would once have been. Binance withdrew its Markets in Crypto-Assets licence application in Greece in June, and as the MiCA transition ended on July 1 it restricted services in several member states, including France, Italy, Poland and Spain, while seeking approval elsewhere. ESMA has warned that customers of unlicensed providers do not get MiCA's asset-protection safeguards. The hack gives EU supervisors a ready case study for why those safeguards exist.

The checkpoints are near. The first is whether withdrawals actually reopen on the stated timeline, and for which networks first. The second is the promised proof-of-reserves update and the technical post-mortem, which should say how an internal service was able to move billions without keys leaving their vaults. The third is how much of the $3 billion frozen pool can be returned, and through what legal process. DefiLlama has recorded more than $8.7 billion in crypto hack losses this year, according to CoinDesk, and this single incident accounts for most of that.

This article is for information only and is not investment advice.

Sources

• CoinDesk · Binance arranges $6.34 billion to cover losses from record crypto hack
• CBS News / AP · $6.3 billion Binance hack was likely work of North Korea, blockchain intel firms say
• Cointelegraph · Live updates: Binance $6.3B hack linked to North Korea's TraderTraitor
• ITP.net · Binance hack: $6.34bn reserved to cover losses as withdrawals remain paused
• PANews · OKX CEO calls for industrywide security standards
• Decrypt · Binance withdraws MiCA license application in Greece