Binance resumes withdrawals after record $6.3B crypto theft

World's largest cryptocurrency exchange Binance has resumed user withdrawals following a major cyberattack that resulted in the theft of $6.3 billion in digital assets. The company announced that it has successfully recovered and replenished 95% of the lost funds.

• Binance resumed withdrawals following a massive $6.3 billion cyberattack.
• The exchange has recovered 95% of stolen funds, while the remaining 5% consists of low-liquidity tokens.
• Investigations by the FBI and TRM Labs link the hack to the North Korea-affiliated hacker group TraderTraitor.
• This incident marks the largest cryptocurrency theft in history.

Attack Details and Withdrawal Status

During the cyberattack, malicious actors gained control over the hot wallet transaction-signing infrastructure of Binance, transferring funds across ten different blockchains. Transaction history analysis showed that the bulk of the stolen cryptocurrency left Binance wallets within just 20 minutes. At the time of publication, withdrawals for certain less common digital assets remained temporarily unavailable.

The remaining 5% of stolen tokens were classified by Binance as low-liquidity assets, meaning acquiring the necessary volume to replace them will take additional time. The exchange stated it is working closely with industry partners to recover the rest of the funds. The scale of this attack is roughly four times larger than the Bybit breach in 2025.

Investigation and North Korean Connection

The attack is being investigated by analytics firm TRM Labs and the U.S. Federal Bureau of Investigation (FBI). Both organizations attribute the breach to the TraderTraitor hacking group, believed to have ties to North Korea. According to the FBI, the same group was responsible for the $1.5 billion theft from Bybit in February 2025 and a $387 million breach at Bitget.

Ari Redbord, head of policy at TRM Labs, emphasized that these are professional operatives connected to military forces rather than standard commercial hackers. He warned that the stolen funds could be utilized for weapon proliferation and destabilizing international security. Consequently, the FBI urged crypto companies to block transactions involving wallets linked to TraderTraitor.

Market Implications and Security

The breach serves as a stark reminder of the security challenges facing centralized cryptocurrency exchanges and highlights the importance of robust hot wallet infrastructure. For users and businesses, the incident underscores the necessity of strict risk management and asset diversification, reinforcing the importance of hardware wallets for long-term secure storage.