Cryptocurrency exchange Binance and an international coalition of blockchain investigators, stablecoin issuers, and law enforcement agencies are grappling with what experts describe as the largest bank robbery in human history after hackers stole more than $6 billion in a brazen cyberattack.
The breach, which security firms TRM Labs and others attributed to an elite North Korean hacking unit known as TraderTraitor, targeted internet-connected hot wallets on Binance’s trading platform. According to the exchange, the entire unauthorized siphoning operation was executed in roughly 20 minutes. In an initial investigation, Binance stated that the incident may have involved a compromised laptop, while a subsequent probe uncovered additional points of breach.
Ari Redbord, global head of policy at TRM Labs and a former federal prosecutor, explained the mechanics of the vulnerability. The way a cryptocurrency exchange works is basically just like a bank, he noted, where customer funds reside in exchange-controlled wallets. What North Korea was able to do, Redbord said, was breach those hot wallets where Binance was keeping the funds.
As it works to recover the assets, Binance vowed in a social media post to cover all customer losses using company funds, stating it will pursue all available avenues to identify those responsible and hold them accountable.
The recovery effort has unfolded at unprecedented speed, according to Redbord, who called it the fastest and largest he has ever witnessed. The initial defense relied on rapid blocking mechanisms. Within an hour of the attack, stablecoin issuers Circle and Tether froze $2.4 billion of the stolen assets. Additional assets were frozen by Ripple and World Liberty Financial, the Trump family’s crypto venture, bringing the total amount of frozen crypto assets to $3 billion, according to a Binance spokesperson.
Stablecoins, which are digital currencies pegged to stable assets like the U.S. dollar, possess a unique architecture that allows issuers to block transfers anywhere in the world. However, roughly $2.4 billion of the stolen haul consists of bitcoin and ether, which move on public blockchains and cannot be frozen by any issuer. Those funds remain beyond any issuer’s reach, according to a TRM Labs blog post. Redbord noted that the best shot at recovering those unfreezed assets is if the thieves attempt to convert the crypto into regular fiat currencies or cash.
To actually claim the $3 billion in frozen funds, stablecoin issuers must first move the assets into secure wallets inaccessible to North Korea. Law enforcement agencies then follow up with seizure warrants requiring the physical transfer of those funds to a U.S. government account. From there, government officials must initiate civil forfeiture proceedings in court. Redbord explained that the government must formally demonstrate that the funds were associated with the illicit activity, representing the final step before the assets can be taken permanently from the bad actor and transferred to the government or victims.
Meanwhile, the cyberattackers are likely laundering the remaining funds to evade detection. Roman Bieda, chief intelligence officer at Swiss blockchain intelligence firm Recoveris, warned that unrecovered funds could be weaponized by North Korea to circumvent international sanctions and finance illicit transactions with countries like Russia. Bieda emphasized a vital distinction in the recovery pipeline, noting that freezing assets and recovering them are two very different things.
Bieda pointed to the sheer scale of North Korea’s cyber operations, noting that TraderTraitor also targeted the Bybit cryptocurrency exchange in 2025 in an attack that resulted in a $1.5 billion loss, according to the FBI. Given the unprecedented magnitude of the Binance theft, experts say it remains unclear how long the recoupment process will take. Bieda cited a past case where his team worked for a Swiss client and required 14 months just to recover $10.5 million in stolen crypto.
Tracing where the capital flows is only half the battle, Bieda added. Knowing whom to contact and reaching those stakeholders before digital assets move again can make all the difference, making a notoriously unpredictable process exceptionally challenging.
