Binance Hack, $6.3B Losses: North Korea’s TraderTraitor Link Reported

Binance is treating a reported multibillion-dollar security incident as a targeted hack tied to activity on at least one Ethereum wallet, triggering rapid freezes by stablecoin issuers and blockchain security providers. As investigations continue, the exchange says the estimated total impact is around $6.3 billion and that $3 billion worth of crypto has already been verified as frozen.

For users, Binance’s immediate priority is operational stability and containment. Deposits are operating normally, while withdrawals are expected to resume within 48 hours after the exchange completes a security revamp of its withdrawal process and related addresses.

Key takeaways

• Binance estimates the hack’s total impact at about $6.3 billion, with $3 billion currently verified as frozen.
• Withdrawals are expected to resume within 48 hours; Binance says deposits remain operational.
• Frozen assets span multiple stablecoins and tokens, including USDT, USDC, RLUSD, USD1, XUSD and gold- and dollar-pegged products.
• Cybersecurity researchers and onchain investigators point to North Korea-linked actor TraderTraitor as the likely culprit.
• Aave, along with other market participants, moved to freeze or adjust operations after receiving signs of exploit-linked activity.

What Binance says happened—and what’s frozen

In its updates, Binance reported that the incident involved multiple factors and that investigators are tracing the full attack path through what it suspects was the entry point via a compromised computer belonging to a DevOps engineer. Binance said it found no evidence of a private-key leak, while noting its inquiry is ongoing.

The exchange also confirmed a shift in its operational posture. At one stage it suspended withdrawals and temporarily paused deposits and trading-related activity as it completed security checks, froze funds, and coordinated with law enforcement and issuers. Later, Binance said deposits would remain available and that withdrawals would stay paused while the withdrawal service and associated addresses are remediated.

Binance’s verified frozen figure rose over time. It previously cited $2.54 billion in verified frozen assets, and later updated the amount to $3 billion as additional freezes took effect.

Among the assets Binance listed as frozen were Tether USDt (USDT), USDC (USDC), Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX USD (XUSD), USDT0, Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG) and Pax Dollar (USDP), alongside Arbitrum (ARB).

Arbitrum also provided specifics on one freeze action: its Security Council said it executed a transaction to freeze $30.5 million in ARB and Ether, moving the funds into an intermediary frozen wallet. Arbitrum said the original holder’s address would no longer have access, and that further movement would require additional Security Council action or Arbitrum DAO governance.

Investigators: TraderTraitor linked to prior DPRK activity

While Binance’s investigation focuses on technical containment, external analysts have been building a behavioral and historical link to North Korea-linked hacking activity.

Chainalysis co-founder and CEO Jonathan Levin said the hack was likely carried out by TraderTraitor. In a post on X, Levin put the theft at $6.4 billion—slightly above Binance’s $6.3 billion estimate—and said industry partners had frozen approximately $3 billion. Chainalysis said it was continuing to track the funds.

Onchain investigator ZachXBT added a linkage between this Binance incident and a separate prior exploit. He said stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address after arriving via THORChain, suggesting—according to his interpretation—that the same actor may be behind both events.

Blockaid co-founder and CEO Ido Ben-Natan told Cointelegraph that the attack resembled work attributed to North Korea, pointing to the sophistication of onchain preparations, a customer “sweeper” contract, and multiple authorizations. Separate reporting cited TRM Labs attributing the attack to TraderTraitor with “high confidence,” based on “robust on and off-chain intelligence.”

Beyond industry attributions, TraderTraitor has previously been named by the FBI as the group behind the ByBit hack in February of the previous year, reinforcing why analysts see this as part of a familiar threat pattern rather than an isolated incident.

How the breach is being contained across DeFi and stablecoins

As the hack unfolded, multiple parts of the crypto ecosystem moved quickly to reduce risk from exploit-linked capital.

TRM Labs, along with multiple stablecoin providers, said they froze tokens believed to be linked to the compromised activity. The article notes that Tether and Circle coordinated to freeze combined amounts in USDT and USDC, and that issuers continued to support the investigation while assets remained immobilized.

Decentralized lending protocols also reacted. Aave said it froze markets across its V3 and V4 deployments as a precaution after the Binance exploiter deposited and borrowed assets. In an Aave governance forum update relayed by risk provider LlamaRisk, the borrowing included USDT deposits and a WETH borrow, with the update describing the exploiter’s only Aave position across networks and versions at that time. Aave users could continue withdrawing funds and repaying loans, but the protocol blocked new deposits and borrowing to limit the attacker’s leverage and reduce the risk of cascading effects.

LlamaRisk cautioned that if the freeze lasted longer, borrowing rates could rise as liquidity declined with withdrawals. It also said markets would remain frozen until the exploiter’s funds stopped moving and Binance provided greater clarity on containment, followed by a staged reopening.

Centralized exchange disruption—and broader market pressure

Even with containment improving, traders faced short-term volatility tied to the incident. CoinGecko data cited in the report placed Bitcoin near $76,937 and down roughly 4.9% over 24 hours, while BNB fell about 8% and Ether declined about 5.7%. DeFi tokens were also reported lower, including AAVE and Uniswap’s UNI over the same period.

Market sentiment also deteriorated. The report referenced the Bitcoin Fear and Greed Index sliding to “fear” with a score of 30, last seen in August, suggesting that the broader market was reacting to both the hack headline and the uncertainty around how quickly assets would be recovered or fully verified as contained.

Meanwhile, major market makers disclosed exposure to Binance. Wintermute and GSR said they expected no major disruption to their operations, describing their exposure as a limited share of net equity, though neither executive specified a dollar loss or confirmed financial impact.

What to watch next

Binance’s next key milestones are operational: the exchange says withdrawals should restart within 48 hours, but investors should watch for further updates to verified frozen amounts, confirmations about whether any signing infrastructure was compromised (without a private-key leak), and additional protocol-level responses from DeFi and stablecoin issuers as investigators follow the attacker’s trail.