Binance Seeks to Recover $6.3 Billion Stolen by North Korean Hackers

Binance stated on Friday that it is actively working to recover more than $6.3 billion in digital assets stolen by a hacking unit linked to North Korea. A spokesperson for the exchange confirmed that the company is coordinating with law enforcement, blockchain intelligence firms, and industry partners to trace, freeze, and recover the missing funds.

The attack targeted internet-connected wallets on the trading platform, an operation that Binance said took approximately 20 minutes to complete. Ari Redbord, a former federal prosecutor and the global head of policy at TRM Labs, described the incident as the largest bank robbery in human history. TRM Labs and other security firms attributed the breach to an elite hacking unit known as TraderTraitor.

Redbord explained that cryptocurrency exchanges function similarly to traditional banks, holding user funds in wallets controlled by the platform. The hackers breached the so-called hot wallets where Binance kept these funds. Binance pledged in a social media post to cover the full losses using company funds while it pursues all avenues to hold those responsible accountable.

The immediate recovery effort focused on preventing the hackers from moving the money. Within one hour of the attack, stablecoin issuers Circle and Tether froze $2.4 billion in stolen assets. Ripple and World Liberty Financial also froze portions of the funds. In total, $3 billion in crypto assets are currently frozen, according to the Binance spokesperson.

However, roughly $2.4 billion of the stolen funds consist of Bitcoin and Ether. These assets move on public blockchains and cannot be frozen by issuers, according to a blog post from TRM Labs. Redbord noted that the best chance of recovering these specific funds is if the thieves attempt to convert them into regular currencies or cash.

The recovery process now shifts to legal procedures. Stablecoin issuers will move the frozen assets to wallets that North Korea cannot access. Law enforcement will then seek a seizure warrant to physically transfer the funds to a U.S. government account. Following the seizure, government officials must pursue a civil forfeiture proceeding in court to permanently recover the assets for the victims.

Roman Bieda, chief intelligence officer at Swiss blockchain intelligence company Recoveris, warned that freezing assets is distinct from recovering them. He noted that North Korea has a history of using stolen cryptocurrency to circumvent international sanctions and finance illicit activities. The unaccounted funds could be used for transactions with countries such as Russia.

The timeline for full recovery remains uncertain. In a previous case involving a Swiss client, Bieda's team took 14 months to recover $10.5 million in stolen crypto. He emphasized that the process is unpredictable and requires close coordination among multiple stakeholders. Bieda added that identifying the funds is only half the battle, as reaching the right parties before the assets move again is a major challenge.

This incident follows a similar attack by TraderTraitor in 2025, when the group targeted the exchange Bybit. According to the FBI, that earlier attack resulted in a loss of $1.5 billion. Binance’s initial investigation suggested the current incident may have involved a compromised laptop, while a subsequent probe uncovered additional points of breach.

The cyberattackers are likely laundering the remaining funds to evade detection, Redbord said. As the legal process unfolds, the outcome will depend on the speed of coordination between law enforcement, crypto issuers, and other partners involved in tracking the digital assets.