Binance has resumed cryptocurrency withdrawals after recovering 95 per cent of the assets stolen in a record $6.3 billion cyberattack. The platform, the largest cryptocurrency exchange in the world, announced that operations were back online following the breach, although withdrawals for certain less common digital tokens remained temporarily unavailable at the time of publication.
The exchange said the remaining five per cent of unrecovered tokens were low-liquidity assets. Binance explained that purchasing the required amount of those less traded tokens could take more time, adding that it is working with industry partners to restore the rest of the funds.
Founded in 2017, Binance is the world's largest digital currency exchange by daily trading volume, enabling millions of users to trade and store hundreds of cryptocurrencies. In digital asset markets, low-liquidity tokens are niche coins with thin trading activity, which makes buying large quantities difficult without causing sharp price swings.
North Korean hacking syndicate
The attack is being investigated by blockchain analytics firm TRM Labs and the United States Federal Bureau of Investigation (FBI). Both organisations linked the hack to TraderTraitor, a cyber group with ties to North Korea.
According to the FBI, the same group was responsible for stealing $1.5 billion in cryptocurrency from the Bybit exchange in February 2025. The syndicate has also been linked to a $387 million theft from the Bitget trading platform in September.
TraderTraitor is one of several hacking units associated with Pyongyang that intelligence agencies monitor for cyber heists against financial institutions. North Korea has faced widespread international sanctions for years, and cybersecurity experts note that state-backed hackers frequently target digital asset exchanges to generate revenue for the regime.
Hot wallet security breach
According to TRM Labs, the intruders gained control of Binance's hot wallet transaction signing system, the infrastructure that confirms transfers from internet-connected wallets. That access enabled the hackers to transfer stolen funds across ten different blockchains.
Hot wallets are digital wallets connected directly to the web, which cryptocurrency platforms use to process rapid, automatic withdrawals for customers. While hot wallets allow instant payments without manual approval, they carry greater security risks than offline cold storage, where cryptographic keys remain disconnected from internet networks.
An analysis of transaction history showed that the vast majority of the stolen cryptocurrency left Binance's wallets in just 20 minutes. The incident ranks as the largest cryptocurrency theft in history, with the total loss roughly four times greater than the previous record set during the Bybit attack in 2025.
Weapons proliferation warning
The FBI urged cryptocurrency firms and service providers to block all transactions involving digital wallets linked to TraderTraitor. Ari Redbord, the head of policy at TRM Labs, said the hackers are not ordinary commercial criminals seeking personal gain, but professionals connected to North Korea's armed forces.
Redbord warned that the stolen funds could be used to finance weapons proliferation and other activities that destabilise international security. Many technical details of how the breach occurred remain unknown, and Binance said it continues to work with industry partners to recover the remaining missing funds.
