Binance Confirms $6.3 Billion Withdrawal Halt as Hackers Drained Digital Assets

The world's largest cryptocurrency exchange has suspended withdrawals to protect user funds following a massive theft. Binance stated on Friday that deposits remained unaffected during the incident. The company expects to resume withdrawal functions within one to two days. Binance assured customers that it will cover all losses incurred by the breach.

U.S.-based blockchain intelligence firm TRM identified the attacker as TraderTraitor, a North Korean hacking unit. TRM posted on its website on Thursday that it attributed the attack to this group with high confidence. The firm noted that several features of the current attack match previous North Korea-linked heists. This includes the $1.5 billion hack on Bybit in February of last year. The FBI previously confirmed North Korea's role in the Bybit incident.

Chainalysis, another blockchain analysis company, reached a similar conclusion. CEO Jonathan Levin wrote on X that the hack was likely done by the DPRK group TraderTraitor. The Democratic People’s Republic of Korea is the official name for North Korea. A Binance spokesperson declined to confirm the specific group but said the company is working closely with law enforcement partners to identify the criminals.

TRM reported that an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains. The transfer occurred mostly within a 20-minute window. This amount makes the incident the largest cryptocurrency theft on record. The firm stated that an initial investigation suggested a compromised laptop was involved. A subsequent investigation uncovered additional points of breach within the system.

Binance announced that it worked with blockchain partners to freeze roughly $3 billion in affected assets. The company said it found no evidence of any wallet private key leak. Binance plans to release more technical details when its probe is complete. The exchange had previously stated that an initial investigation suggested the incident may have involved a compromised laptop.

Changpeng Zhao, the founder of Binance, commented on the event via X on Thursday. He stated that user funds are safe despite the theft looking like a hack on the platform. Zhao added that as a shareholder, he expects all user funds to be fully covered. Zhao pleaded guilty to a felony in 2023 related to money laundering on the platform. U.S. President Donald Trump pardoned Zhao in 2025.

Cybersecurity experts have raised questions about the control measures in place at the time of the hack. Kok Tin Gan, cofounder and CEO of NyxLab, said the incident raises questions about why stronger approval controls were not present. He described the breach as a single signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets are digital storage connected to the internet that hold private keys.

North Korea has turned to crypto hacking to generate foreign currency. This activity helps support its economy and fund its nuclear program. U.N. sanctions have limited other revenue sources for the country. In December 2022, South Korea’s spy agency estimated that North Korean hackers had stolen $1.1 billion in digital assets over five years. More than half of that total was stolen in 2022 alone.

The current event follows a pattern of high-value digital thefts targeting major exchanges. Bybit lost $1.5 billion in a hack in February of last year. That incident was also linked to TraderTraitor. The current Binance breach involves a significantly larger sum of money. The exchange has paused outbound transfers to stabilize its systems while it investigates the source of the unauthorized access.