The Binance logo appears on a screen in San Anselmo, California, June 6, 2023.
Justin Sullivan | Getty Images
Binance has been hacked, with losses estimated at $6.3 billion, raising questions about the recovery of stolen funds and the broader impact on the cryptocurrency market. Approximately $3 billion in virtual currency assets have been frozen so far.
The exchange promised to compensate for all losses, but blockchain researchers linked the attack to North Korea and analysts assessed the potential financial risks.
Bitcoin was under pressure on Friday, trading below $78,000.
Can I get my frozen funds back?
Ari Redboard, head of global policy at blockchain intelligence firm TRM Labs and a former U.S. federal prosecutor and Treasury official, said freezing cryptocurrencies prevents them from being transferred, but requires another legal process to recover the funds.
“The freeze will stop the movement of funds and will be recovered through legal procedures,” Redboard told CNBC.
Redboard said law enforcement typically works with stablecoin issuers to obtain a court order or seizure warrant before releasing or reissuing assets and returning them to their rightful owners.
He said, “Stablecoins are the most recoverable asset class of cryptoassets because the issuer controls the token contract.” “Tether and Circle can be frozen, written to, and reissued, allowing frozen USDT and USDC to be returned to victims.”
However, recovering Bitcoin and Ether is more difficult as no issuer can freeze the assets directly. Instead, investigators must trace funds through exchanges and other crypto services where they can be intercepted, Redboard added.
Eric Jardine, head of research at blockchain analysis firm Chainalysis, said returning frozen assets will require coordination between law enforcement, exchanges and token issuers.
“There is no standard recovery schedule. A technical freeze can happen quickly, but the return of funds can take months or even years,” Jardine told CNBC.
Jardine added that while Bitcoin and Ether cannot be frozen by their issuers, they can be tracked and potentially recoverable. He said investigators can track the funds on public blockchains and intervene if they reach a cooperating exchange or another centralized platform.
Who is behind it?
Based on on-chain and off-chain intelligence, TRM Labs has determined with high confidence that this attack was the work of TraderTraitor, a North Korean government-backed hacking force.
The FBI previously identified the same group as responsible for the $1.5 billion Bybit hack in February 2025, according to company insights.
TRM Institute said the Binance attack shares characteristics with previous North Korea-related incidents, including preparations well in advance of the theft and transaction signatures obtained in advance.
The company estimated that approximately $6.36 billion in digital assets were moved from Binance wallets across 10 blockchains, most within about 20 minutes.
According to TRM Labs, preparations for the attack began at least 36 hours before the theft, and the attackers used cryptocurrency mixing service Tornado Cash to fund the wallets ahead of the breach.
Chainalysis also pointed to North Korea, with co-founder and CEO Jonathan Levine saying the company assesses that the $6.4 billion Binance hack was likely carried out by Trader Traitor, citing a link to past attacks.
Does this pose a financial risk?
Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, said the attack does not appear to pose a significant solvency risk to Binance at this time.
“Most importantly for the market, we do not believe this creates a material solvency risk for Binance at this time,” Farrell said.
Farrell estimated that about $3.3 billion in assets are unfrozen. Assuming the frozen stablecoins are eventually returned, Binance’s SAFU emergency fund (valued at about $1.2 billion) could cover about a third of the remaining losses, with the remainder coming from the exchange’s own funds.
Farrell said the key indicators to watch are how quickly Binance resumes withdrawals and whether outflows remain orderly. He added that the lack of customer assets could force exchanges to sell their reserves, triggering a broader sell-off across the crypto market.
“I don’t think that’s the situation we’re dealing with, but the key will be how quickly withdrawals resume and whether the outflow can be orderly,” Farrell said.
What does hacking mean for cryptocurrency security?
Chris Perkins, head of Franklin Crypto at Franklin Templeton, said the Binance hack highlighted the need for stronger cybersecurity standards and greater cooperation between governments.
Speaking on CNBC’s “Squawk Box Asia,” Perkins said the industry must address cybersecurity challenges to reach its full potential and called for stronger defenses and policies to hold cybercriminals accountable.
“We need to make sure the standards are incredibly high, but we need to focus on the criminals,” Perkins said.
Perkins called for increased international cooperation to address cybersecurity threats, pointing to regulatory cooperation among G20 countries after the global financial crisis as a potential model.
He also said that AI could help improve cybersecurity by identifying and addressing vulnerabilities, even if the technology is used by both attackers and defenders.
