Billions Vanish From Binance While Withdrawals Freeze

More than $6 billion walked out the door of the world's biggest cryptocurrency exchange in about 20 minutes, and by Friday the people who'd stored money there were locked out. Binance said withdrawals have been suspended and are expected to resume in the next day or two. Deposits, the company says, were unaffected. In other words: the exchange will gladly take your money in. Getting it back out is a matter of waiting on the company's timetable.

TRM, a U.S.-based blockchain intelligence firm, said an attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes. TRM attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit. "We make this judgment with high confidence," the firm said. Chainalysis co-founder and CEO Jonathan Levin wrote on X that his firm also believed TraderTraitor likely did it. Binance itself declined to confirm any North Korean link. A spokesperson said only that the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."

Who Has the Power

The response so far runs straight up the chain of command. Binance's co-CEO Richard Teng posted a nearly five-minute video on X saying the company is "working nonstop to resolve this" and working with "law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen funds." Asked at the White House, President Donald Trump said U.S. officials were investigating. On North Korea's involvement, he offered: "We're looking at that."

The company says it has reserved more than $6.34 billion of its own funds to cover the stolen assets and has promised to cover all losses. It froze roughly $3 billion in affected assets with blockchain partners, about half of what was taken. Note who decides what gets frozen, what gets covered, and when anyone can touch their own money again. That's a private company with a reserve fund and a promise, and no one outside its walls gets a vote.

Who Gets Crushed

The people at the bottom of this are the users whose assets sat on the platform. Teng insisted that "user assets are held under Binance's established security architecture" and that "the vast majority sits in cold wallets." Yet he also confirmed that Binance's own hot wallet was affected. Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, said the hack raised questions about why stronger approval controls weren't in place. "This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said.

One signature. Billions of dollars. That's what the centralized model looks like when it fails: a single point of control, and a single point of collapse.

Binance first suggested a compromised laptop, then said a subsequent investigation uncovered additional "points of breach." Teng said the attackers used complex tactics, including a "self-destruct mechanism" making the incident harder to investigate. Meanwhile, independent analyst Garrick Hileman said there's evidence the hackers are already moving and converting some of what wasn't recovered. "The bottom line is there are places in the world where you can take your bitcoin and get that converted," he said.

What They're Calling Security

This isn't new, and the source makes that plain. Bybit lost $1.5 billion in February 2025, about one year and eight months ago, and the FBI blamed North Korea and TraderTraitor for that one too. South Korea's spy agency said in December 2022, nearly four years ago, that North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in cryptocurrency over the previous five years. Experts say Pyongyang turned to crypto theft for badly needed foreign currency under tough U.N. sanctions.

Security executive Andy Ward of Absolute Security offered the industry's shrug: "A cyber attack of this level is a matter of when, not if." He added that it is "likely only a matter of time before an even larger hack, with even greater financial fallout, makes headlines."

So the pattern holds. A concentrated pile of money attracts state-backed thieves, a corporation promises to make victims whole, governments announce they're "looking at that," and the next heist is already described as inevitable. Founder Changpeng Zhao noted on X that earlier attacks, like Mt. Gox, hit harder in terms of bitcoin amount affected. Everyone's busy ranking the disasters. Nobody in the source is asking why so much money sits behind so few keys.