The $6.3 Billion Binance Hack: What North Korea's TraderTraitor Stole, What Was Frozen, and What Comes Next - Latin Times

The breach represents a staggering blow to the cryptocurrency industry, nearly doubling the total amount stolen from the entire sector throughout 2025. Binance confirmed the attack, which saw funds drained across ten separate blockchains in a meticulously coordinated operation that took just 20 minutes to execute.

The entry point was deceptively simple. According to Binance's preliminary findings, a compromised DevOps engineer's laptop gave the attacker access to a service container, from which a wave of unauthorized withdrawal transactions was triggered. Blockchain intelligence firm TRM Labs tracked approximately $6.36 billion leaving Binance's hot wallets across ten blockchains.

North Korean Hackers Suspected

Two leading blockchain forensics firms have attributed the attack to TraderTraitor, North Korea's elite state-sponsored hacking unit. Chainalysis co-founder and CEO Jonathan Levin said his firm was "confident" in the attribution, pointing to established laundering patterns and a critical discovery: stolen Binance funds commingled directly with assets taken in a separate Bitget breach the prior month, which was also tied to Pyongyang.

Industry Response

The cross-industry response was swift and unusually coordinated. Stablecoin issuers Tether and Circle together froze more than $2.3 billion in assets linked to the hackers' wallets. Ripple locked down roughly $200 million in additional funds. Binance confirmed that total frozen assets reached approximately $3 billion, though investigators cautioned the number remains subject to change.

World Liberty Financial — a crypto venture associated with the family of U.S. President Donald Trump — also disclosed that it coordinated with digital asset custodian BitGo to freeze a portion of the stolen funds, illustrating how broadly the industry mobilized in the hours after the breach became public.

Binance Pledges Full Coverage

Despite the staggering scale of the breach, Binance was unequivocal: user funds are safe, and the exchange will absorb every dollar of the loss. The company pointed to more than $6.34 billion in reserved company funds to cover the incident. Deposits and withdrawals were suspended while security teams audited the platform's infrastructure.

Binance's SAFU emergency reserve — a $1.2 billion fund established in 2018 as a last-resort buffer — covers roughly a third of the losses left unfrozen after industry freezes. The remainder comes from Binance's own balance sheet, which holds approximately $144 billion in assets under custody. Co-founder Yi He posted on X that withdrawal services were expected to resume by Sunday.

Market Impact

Bitcoin fell more than 4 percent to approximately $77,994 in the hours after the news broke, reversing a nine-percent rally that had taken place earlier in the week. The scale of the breach is almost without precedent, as Chainalysis and TRM Labs estimate that approximately $2.7 billion in cryptocurrency was stolen across the entire industry throughout 2025 — across more than 140 separate incidents.

This single attack nearly doubled that annual figure in less than half an hour. The previous record holder — the Bybit breach of February 2025 — clocked in at approximately $1.5 billion, less than a quarter of what was taken from Binance. As cybersecurity expert Michael Redbord noted: at this scale, the breach is "a global security issue, not just a crypto theft."