Crypto giant Binance attempting to recover $6.3bn after hack
Constantvpn.com – Crypto giant Binance attempting to recover $6.3bn (£4.7bn) in stolen cryptocurrency says it has already secured roughly $3bn in digital assets. The exchange is working with law-enforcement agencies and blockchain investigators to trace the remainder after what is believed to be the largest crypto theft on record.
Binance initially considered whether a compromised laptop used by a DevOps engineer had provided access to its systems. Its later investigation concluded that the operation involved additional breaches, suggesting a wider and more complex attack. The hackers also used a self-destruct process to remove tools and evidence, making the investigation harder.
This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
Binance co-chief executive Richard Teng said the incident was not the result of a single employee’s mistake, but a sophisticated operation involving several points of compromise.
Customer funds and Binance’s response
The exchange has said it will cover losses arising from the hack. It temporarily suspended deposits and withdrawals during its immediate response, although it later said deposits had not been affected. Crypto giant Binance attempting to recover the stolen funds has continued efforts to strengthen its systems and identify the assets involved.
Your money is safe, and we’re covering every loss.
Binance says it has enough resources to meet that commitment. Founded in China in 2017, the company says it serves more than 300 million registered users worldwide and reported holding more than $160bn in assets under custody in 2024.
Recovering stolen cryptocurrency can be possible when funds pass through identifiable wallets, centralised exchanges or token issuers able to freeze transactions. However, recovery becomes more difficult when assets are repeatedly moved, swapped into other currencies or routed through services intended to conceal their source.
US agencies trace stolen assets
Binance said its US-facing exchange was not affected. But the stolen assets included US-linked stablecoins, including Tether and Circle tokens, which are designed to maintain a value tied to the US dollar. That has given US authorities an important role in efforts to identify, block and recover the funds.
The US Secret Service said it was pursuing the cryptocurrency and those responsible for the breach. The agency, which investigates financial crime as well as carrying out protection duties, said it was working continuously to locate, freeze, trace and recover stolen assets. Binance has also said it is cooperating with the FBI.
We are working around the clock to identify, freeze, trace, and recover stolen funds.
International cooperation is likely to be central to the case. Digital assets can move quickly between services and jurisdictions, so investigators must do more than identify blockchain addresses: they must connect transactions to people, infrastructure and platforms able to take action.
Legal specialists have noted that Binance’s pledge to cover losses may not resolve every possible customer claim. Individual rights could depend on customer contracts, the relevant jurisdiction and whether an exchange meets its stated commitments.
North Korea-linked hackers under scrutiny
Several blockchain analytics companies have linked the attack to a North Korean hacking operation. TRM Labs said the incident showed similarities to earlier attacks attributed to North Korea, including the $1.5bn (£1.12bn) theft from Bybit in 2025. The Binance theft was substantially larger.
Chainalysis said it had “high confidence” that a North Korean was connected to the operation. Investigators have often associated major cryptocurrency thefts with the Lazarus Group, also known as TraderTraitor, terms used for cybercrime groups accused of acting on behalf of the North Korean regime. North Korea has denied involvement in cybercrime.
Crypto giant Binance attempting to recover the remaining assets faces a difficult task, but the ability to trace transactions publicly on blockchain networks may still help investigators follow where the stolen funds travel next.
FAQ
Will Binance customers lose money because of the hack?
Binance has said it will absorb the losses and that customer money is safe. Customers should still monitor official account notices and security updates from the exchange.
Why can stolen cryptocurrency sometimes be recovered?
Blockchain transactions can be tracked between wallet addresses. Recovery is more likely if funds reach an exchange, stablecoin issuer or other service that can freeze assets.
Who is suspected of carrying out the attack?
Blockchain analytics companies have linked the operation to North Korea, while investigators have examined possible connections to groups commonly known as Lazarus Group or TraderTraitor. North Korea denies involvement in cybercrime.