Binance said Friday it is working to recover more than $6 billion stolen by hackers in what experts have called the largest bank robbery in human history. The cryptocurrency exchange said it will cover the full losses using company funds and is coordinating with law enforcement, stablecoin issuers, blockchain intelligence firms and industry partners to trace, freeze and recover the stolen assets. Security firms attributed the attack to an elite hacking unit linked with North Korea called TraderTraitor, which breached the exchange's internet-connected wallets used for trading. The entire theft took roughly 20 minutes, according to Binance.
The initial phase of recovery has already shown some success. Within an hour of the attack, stablecoin issuers Circle and Tether froze $2.4 billion of the stolen assets, while Ripple and World Liberty Financial, the Trump family's crypto venture, also blocked assets. A total of $3 billion in stolen crypto has been frozen, Binance said. However, roughly $2.4 billion consists of bitcoin and ether, which move on public blockchains and cannot be frozen by any issuer, meaning those funds remain inaccessible to recovery efforts for now.
Converting the stolen cryptocurrency into regular currencies offers the best chance of recovery, according to Ari Redbord, a former federal prosecutor and global head of policy at TRM Labs, a blockchain intelligence firm. Law enforcement will follow a process involving moving frozen assets into secure wallets, obtaining seizure warrants and pursuing civil forfeiture proceedings in court. North Korea is likely already laundering the funds to evade detection, Redbord said. The cyberattackers could use any unrecovered assets to circumvent international sanctions and finance illicit transactions, particularly with Russia, according to Roman Bieda, chief intelligence officer at Swiss blockchain intelligence company Recoveris.
The timeline for full recovery remains uncertain. In a comparable case, Bieda said his team worked to recover $10.5 million in stolen crypto for a Swiss client, a process that took 14 months. Bieda emphasized that the recovery process depends on close coordination between law enforcement, crypto issuers and other stakeholders, and that reaching parties before assets move again presents a significant challenge. In 2025, the same North Korean hacking unit targeted another crypto exchange, Bybit, resulting in a $1.5 billion loss, according to the FBI.
For Binance users, the exchange's commitment to cover all losses means they will not bear the financial burden of the theft, though some stolen funds may remain permanently lost if recovery efforts fail.