Binance freezes $3 billion after massive theft

Binance has frozen approximately $3 billion in cryptocurrency assets following a theft estimated at $6.3 billion. The exchange pledged to cover all user losses, but the recovery process will likely involve complex legal procedures.

The breach occurred over the weekend, with most of the stolen digital assets moving across 10 different blockchains within 20 minutes. By Friday, the financial impact was visible in the market, with Bitcoin trading below $78,000.

Ari Redbord, global head of policy at TRM Labs, explained the difference between freezing and recovering funds. He noted that freezing stops movement, but legal action is required to return assets. Law enforcement typically needs a court order or seizure warrant to work with stablecoin issuers.

Redbord said stablecoins like USDT and USDC are easier to recover because issuers like Tether and Circle control the token contract. They can freeze, burn, and reissue these tokens to return them to victims. Bitcoin and ether are harder to recover because they lack a central issuer.

Eric Jardine, head of research at Chainalysis, added that there is no standard timeline for recovery. While a technical freeze can happen quickly, returning funds may take months or years. Investigators trace these assets on public blockchains and intervene when funds reach a cooperating exchange.

TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit. The firm cited on-chain and off-chain intelligence for this assessment. This group was also previously identified by the FBI as responsible for the $1.5 billion Bybit hack in February 2025.

Preparations for the Binance attack began at least 36 hours before the theft. Attackers used Tornado Cash, a cryptocurrency mixing service, to fund their wallets in advance. Chainalysis co-founder Jonathan Levin also linked the incident to TraderTraitor based on connections to previous attacks.

Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, assessed that the hack does not currently pose a solvency risk for Binance. He estimated that $3.3 billion in assets remain unfrozen. Binance's SAFU emergency fund, worth about $1.2 billion, could cover roughly a third of those remaining losses.

Farrell said the key indicators for markets are the speed of withdrawal resumption and the orderliness of outflows. A shortfall in customer assets could force the exchange to sell reserves, potentially triggering broader selling. He stated that the current setup does not appear to match that risk profile.

Chris Perkins, head of Franklin Crypto at Franklin Templeton, called for stronger cybersecurity standards and greater international cooperation. He suggested looking to G20 regulatory coordination after the global financial crisis as a model. Perkins also noted that AI could help identify vulnerabilities, though it is used by both attackers and defenders.