As of Thursday night in the United States, cryptocurrency firms involved in the recovery operation had managed to freeze approximately $3 billion of the stolen assets, according to the initial reports. However, a substantial portion of the funds remained outside investigators’ control, raising concerns that the attackers could attempt to move the cryptocurrency through different platforms and laundering networks.
Binance confirmed that its initial investigation had identified a possible security compromise involving an engineer’s laptop. According to the exchange, the attackers used access obtained through the device to enter a service container and submit unauthorised withdrawal transactions.
A service container is an isolated computing environment used to operate applications and specific processes. If an attacker gains access to such an environment and exploits its permissions, it can potentially create opportunities to interfere with sensitive operations, including financial transactions.
The incident has drawn particular attention because it highlights how a compromised employee device can potentially become an entry point into critical financial infrastructure. Rather than simply stealing login credentials, the attackers allegedly managed to exploit internal access and transaction authorisation mechanisms to move enormous quantities of cryptocurrency.
Binance has not yet published a complete technical explanation of the breach. However, the exchange said it had temporarily suspended deposits and withdrawals while conducting security checks, revoked authorisations associated with the affected address and contacted law enforcement agencies and blockchain intelligence partners to trace the stolen assets.
The company also assured customers that user funds were safe and promised to cover all losses using its own funds and an emergency asset fund.
The size of the attack has left cryptocurrency analysts stunned. Aravind Srinivasan, head of the systematic over-the-counter business at major cryptocurrency market maker GSR, described the incident as the biggest hack in history in comments to Reuters.
The breach has also surpassed the previous record-breaking cryptocurrency theft involving Bybit, another major digital asset exchange. In February 2025, hackers allegedly stole approximately $1.5 billion from Bybit, an attack that was also attributed to North Korean-linked cybercriminals.
How Did Hackers Move Billions of Dollars?
The technical details of the Binance breach have become a major focus of the ongoing investigation. Blockchain intelligence firms are examining how the attackers gained access, how the withdrawal transactions were authorised and how the stolen assets were distributed across different cryptocurrency networks.
According to blockchain investigators, the attackers managed to transfer cryptocurrency from Binance-associated wallets through a coordinated series of transactions. The movement of funds across multiple networks has made the recovery process particularly complicated.
TRM Labs has been investigating the incident and examining suspicious blockchain transactions connected to the stolen assets. Its findings indicate that the attackers may have exploited weaknesses in Binance’s hot-wallet signing infrastructure.
Hot wallets are cryptocurrency wallets connected to the internet and are commonly used by exchanges to process deposits and withdrawals. They allow customers to transfer digital assets quickly but also create security challenges because they remain connected to online systems.
By comparison, cold wallets store cryptocurrency offline and are generally considered less exposed to remote cyberattacks.
Investigators are examining whether the attackers managed to manipulate the systems responsible for authorising transactions from Binance’s hot wallets. TRM Labs has also highlighted the possible exploitation of Ethereum’s EIP-7702 functionality, which allows externally owned accounts to delegate certain operations through signed authorisations.
According to the firm’s analysis, attackers may have prepared transaction authorisations in advance and used them to execute transfers from compromised wallets.
The investigation also suggests that the operation involved activity across several blockchain networks, indicating that the attackers may have obtained access to broader transaction-signing infrastructure rather than simply compromising one wallet.
Nevertheless, Binance has not independently confirmed every technical detail of this explanation, and the precise method of the attack remains under investigation.
Why Are Investigators Suspecting North Korea?
While the technical investigation continues, several blockchain intelligence firms have identified North Korea-linked hackers as the suspected perpetrators.
TRM Labs attributed the attack to an elite North Korean hacking unit based on what it described as strong on-chain and off-chain intelligence. Singapore-based Pangolin Intelligence has also linked the activity to a North Korean cyber unit.
Chainalysis, another prominent cryptocurrency investigation firm, said it was monitoring the stolen funds as they moved across different blockchain networks, including Bitcoin and Ethereum. A spokesperson for the company told CNN that it had high confidence North Korea was behind the attack.
These assessments are based on similarities between the latest incident and previous cyberattacks associated with North Korean hacking groups. Investigators analyse transaction patterns, wallet activity, technical methods and intelligence collected from earlier incidents to identify possible connections.
North Korea has repeatedly been accused by international authorities and private cybersecurity companies of carrying out cyberattacks targeting banks, cryptocurrency exchanges and financial institutions.
The stolen funds are particularly significant because cryptocurrency theft has become an important source of illicit revenue attributed to North Korean-linked hacking operations. Current and former US and South Korean officials have described these cyber activities as a source of financial support for the heavily sanctioned country.
However, the latest allegations have not yet been established through a public legal finding. North Korea has previously denied accusations of involvement in cyberattacks. CNN reported that it had contacted North Korea’s mission to the United Nations for comment.
How Are Investigators Trying to Recover the Stolen Money?
One of the most important developments following the Binance breach has been the cooperation between cryptocurrency exchanges, stablecoin issuers and blockchain intelligence companies.
Unlike conventional financial transactions, cryptocurrency transfers are recorded on public blockchain networks. This means investigators can examine the movement of digital assets between wallet addresses, identify suspicious transfers and monitor where stolen funds are being sent.
However, identifying a wallet does not necessarily reveal the identity of the person controlling it. Hackers can also move assets between different networks, exchange one cryptocurrency for another and use multiple intermediary wallets to make investigations more difficult.
Despite these challenges, investigators managed to freeze approximately $3 billion worth of stolen cryptocurrency during the initial recovery operation.
Stablecoin issuers have played an important role because certain digital tokens, including USDT and USDC, can be frozen by their respective issuers under specific circumstances.
This gives investigators an opportunity to prevent criminals from transferring or cashing out some stolen assets, provided the funds are held in tokens and wallets covered by those controls.
Nevertheless, freezing cryptocurrency does not automatically mean that the money has been returned to Binance or its customers. The assets must still go through the necessary recovery and verification procedures.
The remaining stolen cryptocurrency presents another challenge. Investigators believe the attackers could attempt to use cryptocurrency exchanges, decentralised financial platforms and international money-laundering networks to convert digital assets into funds that are harder to trace.
Pangolin Intelligence has warned that the battle between hackers and investigators may only be beginning, suggesting that North Korea-linked operators could rely on established networks to move and eventually cash out the stolen funds.
What Has Binance Said About the Massive Hack?
Binance responded to the incident by temporarily suspending deposits and withdrawals while its security teams investigated the breach.
The exchange also revoked the affected address authorisation and began cooperating with law enforcement agencies and blockchain intelligence companies to trace the stolen cryptocurrency.
In its public statement, Binance said it would cover all losses resulting from the incident through company funds and its emergency assets fund. The company also maintained that customer funds remained safe.
Changpeng Zhao, Binance’s co-founder and former chief executive, also commented on the incident through social media platform X. Zhao said the event appeared to be a hack and expressed confidence that users would be fully covered by the exchange.
Zhao stepped down as Binance chief executive in 2023 after pleading guilty in the United States to violating anti-money laundering laws. He was sentenced to four months in federal prison and was later pardoned by US President Donald Trump in October 2025.
Although Zhao no longer manages Binance, he remains its largest shareholder.
The company has not yet provided a complete account of how the attackers managed to compromise its internal systems or whether additional security weaknesses were involved.
How Has the Binance Breach Affected Cryptocurrency Prices?
News of the massive security breach also affected cryptocurrency market sentiment. Bitcoin and Ether, the two most widely traded digital currencies, experienced declines as investors reacted to concerns about the security of major cryptocurrency exchanges.
By Friday midday in Hong Kong, both cryptocurrencies were trading approximately 2-3% lower, although they had recovered some of their earlier losses.
The incident has renewed concerns about the risks associated with keeping digital assets on centralised cryptocurrency exchanges. Unlike stock trading platforms, cryptocurrency exchanges frequently hold digital assets on behalf of their customers, making the security of their internal wallets and transaction systems particularly important.
A major security breach can undermine investor confidence, increase withdrawal activity and create uncertainty across the wider digital asset market.
What Does the Biggest Crypto Heist Mean for the Future of Exchange Security?
The Binance incident has exposed the growing sophistication of cyberattacks targeting the cryptocurrency industry. It also demonstrates that even large exchanges with extensive security infrastructure can face serious threats if attackers manage to compromise employee devices or gain unauthorised access to internal systems.
The incident is likely to intensify discussions about stronger cybersecurity requirements for cryptocurrency exchanges, particularly around employee access controls, transaction approvals and the protection of digital wallets.
Companies operating in the sector may need to strengthen multi-layer authentication, introduce stricter monitoring of employee devices, limit access to sensitive systems and establish additional safeguards for large withdrawals.
Cooperation between cryptocurrency companies and law enforcement agencies will also remain essential. The ability of stablecoin issuers to freeze suspicious transactions demonstrates how coordination across the industry can help limit the financial damage caused by cyberattacks.
For now, the investigation remains focused on identifying the attackers, understanding how they managed to penetrate Binance’s systems and recovering as much of the stolen cryptocurrency as possible.
With more than $6 billion reportedly stolen and billions still requiring recovery, the Binance breach has become a defining security challenge for the cryptocurrency industry. Whether investigators can recover the remaining funds and establish the full extent of North Korea’s suspected involvement will be closely watched by exchanges, regulators and investors around the world.
Important publishing note: The article has been rewritten in original language, but the incident details, dates, financial figures and technical claims should be checked against the original reporting and Binance’s latest investigation before publication. Putin Praises Musk, Points to Orbital Coordination Between Starlink and Rassvet | Maya
