Binance Hack Linked to North Korea as $6.3 Billion in Funds Move

Binance is investigating a major hack after billions of dollars moved out of its hot wallets, the online wallets exchanges use to handle transactions. Tether and Circle froze a combined $1.79 billion in USDT and USDC linked to the incident. Later reports put the stolen amount at $6.3 billion and said blockchain investigators linked the attack to North Korea’s TraderTraitor group, an attribution reported by Bitcoin Magazine and Decrypt.

Binance reopened withdrawals after the incident. The exchange said customers withdrew a net $3.64 billion during the first nine and a half hours after withdrawals resumed—about 2.1% of its assets.

What happened to Binance’s funds?

The initial reports described suspicious outflows from Binance hot wallets, with estimates reaching as high as $5.8 billion. Subsequent reporting characterized the incident as a $6.3 billion hack. Those figures describe different reported estimates; the available reports do not explain the discrepancy.

The freeze by Tether and Circle means the issuers blocked transfers of identified USDT and USDC, potentially preventing those specific funds from being moved. It does not mean all assets connected to the incident were recovered or frozen.

What does the North Korea attribution mean?

Bitcoin Magazine reported that Chainalysis and TRM Labs linked the attack to TraderTraitor, a group associated with North Korea. That is an attribution by blockchain analysis firms, not a finding detailed in Binance’s initial statement that it was investigating.

For customers, the immediate practical detail is that Binance reopened withdrawals, but users moved substantial funds out soon afterward. The $3.64 billion figure is a net outflow—not a measure of losses suffered by customers, nor proof that Binance could not meet withdrawals.

What should Binance users watch next?

The key unresolved issues are Binance’s account of how the breach happened, whether investigators can recover more funds, and whether the exchange reports further changes to withdrawals or operations. If you use Binance, rely on official exchange notices for account-specific guidance; the reported outflows alone do not establish that any individual account was affected.

This incident also shows why a stablecoin freeze is not the same as a general reversal of a crypto theft: issuers can block certain tokens under their control, while funds in other assets or on-chain addresses may remain beyond that kind of intervention. The earlier coverage of the initial hot-wallet outflows and stablecoin freezes describes the first reported response.