Binance, the world’s largest crypto exchange, has recovered 95% of the $6.3 billion stolen in a massive cyberattack earlier this week. The theft, attributed to the North Korean hacking group TraderTraitor, is the largest crypto heist on record, surpassing the $1.5 billion hack of Bybit in February 2025. The exchange resumed withdrawals today, though some less commonly traded cryptocurrencies remain unavailable.
The remaining 5% of stolen funds are described as “less liquid,” meaning they may take longer to recover. Binance is working with industry partners to complete the remaining acquisitions and plans to provide further updates. The FBI and blockchain investigations firm TRM Labs have linked the attack to TraderTraitor, a state-sponsored group also responsible for the $1.5 billion Bybit hack and a $387 million heist on Bitget in September.
According to TRM Labs, the hackers gained control of Binance’s “hot wallet” signing system, allowing them to transfer funds across ten different blockchains within just 20 minutes. The FBI has urged crypto firms to block transactions with wallets linked to the North Korean group. Ari Redbord, global head of policy at TRM Labs, warned that the stolen funds will likely be used for weapons proliferation and other destabilizing activities.