Binance halts withdrawals after an estimated $6.3 billion hack blamed on North Korea, as stablecoin issuers freeze billions

Binance halted trading on Thursday after hackers allegedly linked to North Korea drained an estimated $6.3 billion from its wallets, according to the exchange^1,8.

Two analytics firms have attributed the incident to a North Korean hacking unit called TraderTraitor².

Binance co-founder Yi He said on X that the exchange had suspended deposits and withdrawals, writing that “user funds are safe” and that “Binance will cover all hacking losses”¹.

In a further post on Friday, Binance said all deposits and withdrawals remained suspended while its team conducted security checks⁹.

The firm has since found multiple “points of breach”⁷.

Founder and former chief executive Changpeng Zhao, who no longer runs the company, said “it does look like a hack on Binance”^5,14. He said user funds are safe and that he expects them to be fully covered¹².

Why it matters to investors

At that scale the theft would be the largest in crypto history, surpassing the $1.5 billion taken from Dubai-based exchange Bybit in February 2025, a theft the FBI attributed to North Korea⁹.

Estimates of the damage differ: Binance put the impact at $6.3 billion, while tracking of suspicious outflows showed up to $5.8 billion leaving the exchange^1,12.

Stablecoin issuers moved quickly: Circle and Tether froze more than $2.38 billion of stablecoins on Thursday after Binance said it was investigating a potential security incident⁴.

Tallies of total freezes across issuers range from more than $2.6 billion to about $3 billion^5,13.

Ripple froze 40.5 million of its RLUSD stablecoin, and World Liberty Financial froze 27.8 million USD1 tokens tied to the incident¹¹.

World Liberty Financial, a crypto company linked to President Donald Trump and his family, said it worked with partners, including custodian BitGo, to freeze funds^3,10. Binance has also forged a business relationship with the Trump family’s crypto business⁶.

Bitcoin fell about 5% as news of the breach spread⁷.

What to watch

The key test is whether Binance honours its pledge to cover all losses and how quickly it reopens deposits and withdrawals^1,9.

The episode also shows how much power stablecoin issuers hold to freeze assets on their networks, a feature that limited the hackers’ ability to move part of the haul^4,13.

The attack follows a wave of high-profile cyber intrusions and data breaches during what has been called “Black October,” when a series of security incidents and AI-discovered bugs triggered fears of a global crisis¹.

Any formal attribution by US authorities, and any response from North Korea, will shape how regulators and counterparties treat exposure to the exchange^2,9.