Binance freezes $3 billion linked to $6.3 billion North Korean hack

Binance, the world’s largest cryptocurrency exchange, says it has frozen about half of the $6.3 billion taken in a massive hack, securing roughly $3 billion of the stolen assets. The breach was discovered on Friday and is being described as a “record heist” that could involve a North Korean hacking unit. Binance’s co‑CEO Richard Teng warned that the attack was not the work of a single individual and that the perpetrators used a self‑destruct mechanism to erase evidence.

The incident appears to be wider than the initial theory that a DevOps engineer’s laptop was compromised. Analytics firms have linked the theft to the Lazarus Group, a North Korean state‑sponsored hacker collective known for targeting financial institutions. The hack dwarfs the $1.5 billion theft from the Bybit exchange in 2025 and involved both Bitcoin and stablecoins such as Tether and USDC. Binance has set aside more than $6.34 billion to cover the loss and is actively buying a range of crypto tokens to mitigate the impact.

U.S. authorities are joining the investigation. The Secret Service said it is working “around the clock” to identify, freeze, trace and recover the stolen funds, while the FBI is also involved. Binance assured users that “your money is safe” and that the U.S.‑facing platform was not affected, though the U.S. will retain jurisdiction to pursue the case. The hack sent shockwaves through the market; Bitcoin fell 5 percent to $76,800, Coinbase dropped 12 percent, and Robinhood slid 7.8 percent as investors reacted to the news and mixed earnings reports.

The next steps will focus on tracking the illicit funds across a global network of exchanges and wallets. Law‑enforcement agencies expect a coordinated effort to trace the crypto through mixers and offshore accounts. Binance says it will continue to work with regulators and law‑enforcement to recover the remaining assets. The outcome could set a precedent for how the crypto industry handles large‑scale thefts and may shape future security standards for digital‑asset platforms.