'User Funds Are Safe!': Binance Says After $6.3 Billion Hack Linked by Researchers to North Korea

Binance founder Changpeng Zhao intervened on Friday to halt mounting global market panic, issuing a direct personal declaration that customer balances remain secure following an unprecedented $6.3 billion (£4.69 billion / €5.62 billion) cyber raid.

Writing to millions of followers on the social media platform X, the prominent investor, universally recognised as CZ, addressed the extraordinary capital flight, writing, 'User funds are safe!'

While acknowledging that preliminary data 'does look like a hack on Binance', Zhao took care to emphasise that he no longer manages daily exchange operations following his regulatory departure.

'As a shareholder, I expect all user funds will be fully covered,' Zhao stated, placing public pressure on current leadership to honour depositor guarantees.

Corporate executives moved immediately to reinforce that promise, pledging to deploy the exchange's dedicated Secure Asset Fund for Users alongside company treasury capital to compensate verified balances in full.

The multi-billion-pound safety pledge arrived as blockchain intelligence specialists at TRM Labs attributed the coordinated 20-minute assault across 10 blockchains to North Korean state-sponsored syndicate TraderTraitor, leaving traders weighing exchange solvency against the largest digital asset heist on record.

The suspected North Korean connection follows the February 2025 theft of approximately $1.5 billion (€1.34 billion and £1.12 billion) from rival exchange Bybit. The FBI attributed that attack to TraderTraitor, a North Korean hacking operation.

The exchange has not confirmed that all affected assets have been recovered or that compensation has been completed.

Why Researchers Linked the Binance Hack to North Korea

US blockchain intelligence firm TRM Labs reported that attackers transferred approximately $6.36 billion (€5.68 billion and £4.74 billion) from Binance wallets across ten blockchains. Most transactions occurred within roughly 20 minutes on Thursday.

TRM Labs attributed the operation to TraderTraitor, citing blockchain evidence and similarities with previous North Korean cyberattacks. 'We make this judgment with high confidence,' the firm said in its assessment.

Researchers identified patterns resembling the Bybit breach, including the apparent compromise of systems used to authorise cryptocurrency transfers. TRM Labs described the Binance incident as the largest cryptocurrency theft on record.

Blockchain analytics company Chainalysis reached a similar preliminary conclusion. Its co-founder and chief executive, Jonathan Levin, wrote on X that the attack was 'likely done by DPRK group TraderTraitor'.

DPRK refers to the Democratic People's Republic of Korea, North Korea's official name. Despite those assessments, Binance has not independently confirmed the attackers' identities. The exchange said it was cooperating with law enforcement and blockchain intelligence partners to establish responsibility and pursue those involved.

The distinction remains significant because the researchers' attribution has not been established through a publicly announced law-enforcement finding concerning this particular attack.

North Korea has previously been accused of using cryptocurrency theft to obtain foreign currency despite international sanctions. In December 2022, South Korea's intelligence agency estimated that North Korean hackers had stolen approximately $1.1 billion (€982.55 million and £819.12 million) in virtual assets over five years.

Binance Hack Raises Questions Over Wallet Security

Binance said approximately $3 billion (€2.680 billion and £2.23 billion) of the affected cryptocurrency had been frozen on-chain through cooperation with blockchain partners.

TRM Labs separately identified roughly $2.7 billion (approx. €2.412 billion and £2.011) billion) in frozen assets during an earlier stage of its analysis. The figures reflect different reporting periods and do not necessarily indicate conflicting findings.

Freezing cryptocurrency restricts an attacker's ability to transfer or convert affected assets. However, it does not automatically mean the funds have been recovered or returned to Binance.

According to Binance's security update on 30 October, its preliminary investigation suggested that a compromised DevOps engineer's laptop may have provided attackers access to an internal service container.

That access potentially allowed unauthorised withdrawal transactions to be submitted. The exchange subsequently reported discovering additional breach points, although investigators have not established the full sequence of events.

Binance co-chief executive Richard Teng stressed that investigators had not attributed responsibility to any individual. The suspected compromise of an employee's device does not establish that the employee knowingly participated in the attack.

The exchange also said it had 'found no evidence of any wallet private key leak.' It promised a detailed technical report once investigators had verified the circumstances.

Kok Tin Gan, co-founder and chief executive of cybersecurity company NyxLab, questioned whether stronger transaction approval controls could have prevented the transfers.

'This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,' Gan said.

Hot wallets remain connected to the internet to facilitate cryptocurrency transactions, exposing them to cyberattacks. Gan's assessment remains a technical hypothesis rather than a confirmed explanation of the breach.

Binance temporarily suspended deposits and withdrawals during its security checks. The company subsequently said deposits were unaffected, while withdrawals remained suspended pending improvements to its security systems.

The exchange confirmed that affected customers will receive full compensation through its established Secure Asset Fund for Users alongside direct corporate resources.

The dedicated insurance mechanism, commonly abbreviated as SAFU, was established to absorb extreme, catastrophic losses resulting from systemic security breaches.

The incident also places renewed attention on Zhao's history with the exchange. He founded Binance in 2017 and resigned as chief executive in November 2023 after pleading guilty to failing to maintain an effective anti-money-laundering programme under the US Bank Secrecy Act. President Donald Trump pardoned Zhao on 21 October 2025.

While Zhao's intervention provided vital psychological reassurance to depositors, the ultimate recovery of customer funds depends upon Binance's capacity to restore operational integrity.

For Binance customers, the company's reimbursement pledge offers reassurance, but significant questions remain. Investigators have yet to determine the full attack method, establish responsibility or confirm how much of the stolen cryptocurrency can ultimately be recovered.