After pirates stole more than $6 billion from BinanceThe cryptocurrency exchange said Friday it was working to recover the assets, a multi-pronged process that experts say involves coordinating with law enforcement and tracking the movements of the stolen funds.
“Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds,” a Binance spokesperson said in a statement to CBS News.
Ari Redbord, a former federal prosecutor and global head of policy at TRM Labs, a blockchain intelligence firm that tracks stolen funds, called the heist “the largest bank robbery in human history.”
TRM and other security firms attributed the attack to an elite hacking unit linked to North Korea known as “TraderTraitor.” The funds were siphoned from internet-connected wallets on Binance’s trading platform, Redbord said. The entire operation took around 20 minutes, according to Binance.
“How a cryptocurrency exchange works is fundamentally similar to how a bank works. People put their funds in the bank, and those funds go into wallets controlled by the exchange,” Redbord told CBS News. “What North Korea was able to do was get into the hot wallets where Binance was keeping all these funds.”
As it works to recover stolen assets, Binance pledged in a social media post to cover all losses using company funds.
“We will use all available avenues to identify those responsible and hold them accountable,” Binance said.
How does the recovery process work?
Redbord called the effort to recover Binance customer funds “the fastest and largest” it had ever seen.
The first step was to prevent hackers from transferring the funds. Less than an hour after the attack, stablecoin issuers Circle and Tether had frozen $2.4 billion in stolen assets, it said. Ripple and World Liberty Financial, the Trump family’s crypto business, have also frozen their assets, according to TRM Labs.
Issuers of stablecoins – a type of cryptocurrency tied to a stable asset, such as the US dollar – can block the transfer of their tokens anywhere in the world, speeding up recovery efforts. In total, $3 billion in crypto assets have been frozen, Binance spokesperson told CBS News.
However, approximately $2.4 billion in stolen funds consist of Bitcoin and ether – these funds are now “out of reach of any issuer,” according to a TRM Labs blog post.
Bitcoin and Ethereum “evolve on public blockchains and cannot be frozen,” Redbord said. “This is a very, very specific capability that (only some) stablecoin issuers have.”
The best chance of recovering these funds is if thieves attempt to convert the crypto into regular currencies, including cash, he added.
In a social media post, Binance said an initial investigation suggested the incident may have involved a compromised laptop, while a subsequent investigation revealed additional “breach points.”
According to Redbord, cyberattackers are now likely laundering stolen funds to evade detection by law enforcement.
How long will it take to recover the funds?
To actually recover the frozen funds, stablecoin issuers will first move the assets into a wallet that North Korea does not have access to, he said.
“Law enforcement will follow up on what they call a ‘seizure warrant,’ which basically says we need you to physically transfer these funds to a U.S. government account,” Redbord told CBS News.
Once the funds are seized, government officials will need to initiate civil forfeiture proceedings in court to recover the crypto assets.
“The government must demonstrate that the funds were associated with the activity in question,” Redbord said. “This is the final step before funds can be permanently withdrawn from the bad actor and returned to the government or victims.”
Any Binance funds that are not recovered could be used by North Korea to conduct illicit transactions with countries like Russia, Roman Bieda, director of intelligence at Recoveris, a Swiss blockchain intelligence firm, told CBS News.
“Freezing assets and recovering them are two very different things,” he said. “North Korea has a history of using stolen cryptocurrencies to circumvent international sanctions and finance its activities.”
In 2025, TraderTraitor also targeted another crypto exchange, Bybit, in an attack resulting in a loss of $1.5 billion, according to the FBI.
Given the scale of the Binance theft, it is unclear how long it will take for the crypto exchange to recover the stolen assets. In one case, Bieda said his team worked for a Swiss client and it took 14 months to recover $10.5 million in stolen crypto.
“The process remains unpredictable,” he said in an email, noting the close coordination required between law enforcement, cryptocurrency issuers and other stakeholders to trace the funds. Figuring out where the money went is only half the battle, he said.
“Knowing who to contact and reaching them before assets are moved again can make all the difference, and it’s definitely a challenge,” Bieda said.
Gn bussni
