Overview
- Binance disclosed the attack on Thursday after hackers removed about $6.3 billion and the exchange temporarily halted deposits and withdrawals to contain the breach.
- The FBI publicly attributed the theft to TraderTraitor, a group linked to North Korea, a finding earlier flagged by blockchain analyst TRM Labs and followed by agency requests to block specific addresses.
- Binance says it has secured or replaced roughly 90% of the stolen assets using about $6.34 billion of company funds and that partners have frozen about $3 billion of the proceeds.
- Early forensic work and Binance statements point to a compromised employee laptop and extremely fast transfers that moved much of the loot within around 20 minutes, highlighting endpoint and human risks.
- The incident pushed crypto prices lower, intensifies regulatory pressure on custodial exchanges—noting Binance lacks a MiCA license in the EU—and raises questions about how stolen crypto is traced, frozen, and used to evade sanctions.