Hackers behind the record $6.3 billion theft from Binance are employing sophisticated money-laundering techniques that have not been observed before, according to blockchain analysis firm Chainalysis. The attackers are using automated systems to obscure the movement of stolen funds and stay ahead of law enforcement efforts to freeze and recover the assets, The Guardian reported. The incident represents the largest cryptocurrency heist in history, with investigators working to trace and recover the stolen digital assets.
The attack has triggered a broader market downturn, with cryptocurrency-exposed stocks falling sharply and concerns emerging about potential solvency risks. Binance has committed to covering all losses to its users and has begun working with law enforcement agencies worldwide, including the Federal Bureau of Investigation and the United States Secret Service, to recover the stolen funds.
How are the attackers hiding the stolen funds?
Rather than simply transferring stolen assets to new addresses, the attackers are repeatedly circulating funds among multiple addresses, often sending money back to addresses involved earlier in the sequence. Chainalysis identified that thousands of transactions have occurred in a short timeframe, indicating the use of automation to obscure the trail of funds and complicate tracking efforts.
The attackers faced a particular challenge with stablecoins such as USDT and USDC, which can be frozen by their issuers in coordination with law enforcement. While billions of dollars in unfreezable cryptocurrencies like Bitcoin and Ethereum remained under their control, billions more were held in these freezable assets. To stay ahead of the freeze process, the attacker rapidly moved $500 million in stablecoins into a wallet designed to swap those freezable assets into non-freezable ones. Over nearly 20 minutes, the wallet converted $325 million in stablecoins into $285 million in ETH. Ten minutes later, the attacker sent the remaining $175 million in stablecoins to intermediate wallets in an attempt to move faster than industry blacklists or freeze orders could be implemented. However, the industry responded more quickly than anticipated: by 5:14 p.m. Eastern time, the freezes began.
According to Chainalysis, the exploit has been attributed to North Korean cybercrime group TraderTraitor, based on direct on-chain links to funds from a separate Bitget exploit previously attributed to North Korean actors. The investigation remains ongoing, with the stolen funds expected to continue moving in the coming days.
What was the nature of the attack?
Binance's investigation revealed that the breach involved multiple points of entry beyond the initially suspected compromised DevOps engineer's laptop. CEO Richard Teng stated that the attack was considerably more complex than a single engineer's permissions or a one-click action would suggest. The incident appears to have begun with the compromise of a person rather than a direct platform vulnerability, according to cybersecurity experts.
Suzy Pallett, president of the international cybersecurity conference Black Hat, noted that
the Binance incident looks set to become the biggest crypto heist in history, and what's striking is how familiar this playbook is. Billions can vanish because one person clicked the wrong thing, and with cyberattacks like these, it all starts by compromising a person, not a platform.She emphasized that understanding how stolen funds are laundered and converted to usable currency requires close collaboration between journalists, law enforcement, and the cybersecurity industry.
According to Yahoo Finance, blockchain intelligence firm Arkham estimated the haul at $6.01 billion, taken from Binance hot wallets across nine blockchains between 4:10 p.m. and 7:05 p.m. ET. Arkham reported that approximately $2.80 billion has been frozen and $2.9 billion remains movable. Attacker-linked wallets sent $38.82 million in ETH to a new address early on Friday and still held $1.12 billion in ETH at the time of reporting.
What is Binance's response to the hack?
Binance announced that it has begun recovering affected assets for users and is working with law enforcement, cryptocurrency issuers, blockchain intelligence firms, and industry partners to trace, freeze, and recover additional funds. The exchange stated that it will use its own reserves of crypto assets to cover losses where possible and purchase additional assets in the market.
In an official statement, Binance explained:
Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted. We are completing the purchase of the remaining amount by buying token assets through market channels and OTC channels. We are doing this to match the format of the remaining token assets and address any asset shortfalls. This step can take longer because some tokens may have low liquidity and OTC settlement also takes time.
The exchange noted that these figures do not include frozen or protected assets, which remain subject to ongoing recovery and verification. Currently, $3 billion has been frozen with assistance from industry partners. Binance stated it will continue using company resources to cover confirmed shortfalls and provide further verified updates as recovery efforts progress, with all user funds to be verified publicly through its Proof of Reserves system.
Binance deposits were operating normally on Friday, while withdrawals remained suspended during the security revamp. The exchange said it expected withdrawals to resume in approximately 45 hours.
What legal implications could arise from the hack?
Edwin Coe, head of commercial disputes and class actions at a legal firm, suggested that Binance customers might need to consider legal action to recover losses. While Binance has publicly committed to covering losses, Coe cautioned that
taking the current standard user terms at face value, they contain limits to Binance's liability to customers and I see no commitment on using the Secure Asset Fund. Neither will it be quick. How Binance decides to distribute the funds, to whom and when, the value of Bitcoin being volatile, will create a constellation of additional legal issues for the exchange which it will take time to work through.
Coe warned that
it is very unlikely that voluntarily distributed reserves will be enough and customers will have to seek to compel Binance to make them whole. That will mean litigation. A collective action is sometimes the only way for some in cases like this to seek recourse, pooling resources to make litigation viable for many individual victims.Additionally, litigation may emerge concerning ownership of the assets that have been frozen since the hack's discovery.
How have markets reacted to the Binance hack?
The hack has triggered significant market volatility. Bitcoin fell through support at $80,000 overnight as news of the security breach emerged, closing near $76,000. The next major support level is $75,000, and a break below that could trigger a retest of summer lows when Bitcoin slipped as low as $60,000 in July, representing half its all-time high.
Bitcoin has declined 1.85 percent today to $77,374, adding to a 3 percent drop the previous night. David Morrison, senior market analyst at Trade Nation, warned that
Bitcoin sliced through support at $80,000 overnight as news came through of a security breach at Binance, the world's largest crypto exchange. Binance estimates that the incident could involve as much as $6.3 billion. It has frozen around $3 billion in cryptocurrency so far, and has promised to cover all losses. There is speculation that the hack originated in North Korea. This is a tough one for cryptos. Bitcoin had done a solid job in holding on to support around $80,000 over the past six weeks. But the break was conclusive, as bitcoin closed in on $76,000. The next big level of support is $75,000. But a break below here would open up the possibility of a retest of summer lows.
Shares in companies exposed to the cryptocurrency sector are dropping sharply at the start of trading in New York. Coinbase, the major US cryptocurrency exchange, fell 11.5 percent at the opening of trading. The tech-focused Nasdaq is also suffering early losses, down 2.5 percent overall.
Chip stocks are leading the broader sell-off, following Intel's warning of a slowdown in the PC market. Intel shares have plunged nearly 29 percent in early trading, with rival AMD down 9.3 percent and chip designer ARM down 9.9 percent. Spot silver has also weakened, falling 4 percent and dropping below $50 per ounce for the first time since November 2025.
However, Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, offered a more measured perspective, stating that
the most important takeaway for markets is that this does not currently appear to create meaningful solvency risk for Binance.
What happened between Elon Musk and Binance leadership?
Changpeng Zhao, cofounder and former CEO of Binance, publicly asked Elon Musk not to "troll" the company in the wake of the hack. Zhao appeared frustrated by Musk posting several emojis in response to posts on X about the security breach, including a response to a post reminding people that collapsed crypto exchange FTX had, like Binance, claimed to have sufficient funds to cover client holdings.
In response, Zhao reminded Musk of Binance's financial stake in his ventures, stating:
Elon, have a lot of respect for you, but bad time to troll. Please stop. Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support. Thanks!
Yi He, Binance's chief customer service officer, also weighed in on the exchange's financial position, saying:
Reporting to the major shareholder: Our company's revenue for the year is sufficient to cover the losses, so we do not yet need to sell the SpaceX shares you are bullish on.
What is the broader context of cryptocurrency theft?
The Binance hack represents a significant escalation in cryptocurrency-related crimes. In September 2026, a 22-year-old Singaporean man pleaded guilty to orchestrating a $245 million cryptocurrency theft conspiracy, leading an international network that used social engineering and break-ins to steal bitcoin. Additionally, in October 2025, a businessman and his pregnant wife were beaten and threatened at knifepoint during a violent home invasion in Solihull, with attackers forcing him to transfer hundreds of thousands of pounds in cryptocurrency.
According to CNN, both TRM Labs and Singapore-based Pangolin Intelligence assessed that a North Korean hacking unit was responsible for the Binance theft. The incident has set a record as the largest cryptocurrency heist ever recorded.
What happens next in the investigation and recovery?
Binance is continuing to work with law enforcement agencies worldwide, including the FBI and the US Secret Service, to trace and recover the stolen assets. The exchange has committed to providing verified updates as recovery efforts progress, with all user funds to be verified publicly through its Proof of Reserves system.
The investigation into the attack's origins and methods remains ongoing. Chainalysis indicated that the stolen funds are expected to continue moving in the coming days as attackers attempt to convert and launder the assets. The recovery process is expected to be lengthy, involving coordination between multiple agencies, blockchain intelligence firms, and cryptocurrency issuers to identify, freeze, and ultimately recover as much of the stolen funds as possible.
