What we know and what comes next
Binance was hacked with an estimated impact of $6.3 billion, raising questions about the recovery of stolen funds and the broader fallout for crypto markets. Around $3 billion in cryptocurrency assets have been frozen so far.
The exchange pledged to cover all losses, while blockchain investigators linked the attack to North Korea and analysts assessed the potential financial risks.
Bitcoin was under pressure on Friday and was trading below $78,000.
Can frozen funds be recovered?
Freezing cryptocurrency prevents it from being transferred, but recovering the funds requires a separate legal process, according to Ari Redbord, global head of policy at blockchain intelligence firm TRM Labs and a former U.S. federal prosecutor and Treasury official.
“A freeze stops the money from moving, and recovery follows through legal process,” Redbord told CNBC.
Redbord said law enforcement typically obtains a court order or seizure warrant before working with stablecoin issuers to release or reissue assets and return them to their rightful owners.
“Stablecoins are the most recoverable asset class in crypto because the issuer controls the token contract,” he said. “Tether and Circle can freeze, burn and reissue, which allows frozen USDT and USDC to be returned to a victim.”
But recovering bitcoin and ether is more challenging because they have no issuer that can directly freeze the assets. Instead, investigators must trace funds through exchanges and other crypto services where they can potentially be intercepted, added Redbord.
Eric Jardine, head of research at blockchain analytics firm Chainalysis, said returning frozen assets requires coordination among law enforcement, exchanges and token issuers.
“There is no standard recovery timeline. A technical freeze may happen quickly, while returning funds can take months or years,” Jardine told CNBC.
Jardine added that while bitcoin and ether cannot be frozen by an issuer, they can still be traced and potentially recovered. Investigators can trace the funds on public blockchains and intervene when they reach a cooperating exchange or another centralized platform, he said.
Who is behind it?
TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, based on on-chain and off-chain intelligence.
The FBI previously identified the same group as responsible for the $1.5 billion Bybit hack in February 2025, according to the company’s insights.
TRM Labs said the Binance attack shared characteristics with previous North Korea-linked incidents, including preparations made well before the theft and transaction signatures obtained in advance.
The firm estimated that approximately $6.36 billion in digital assets were moved from Binance wallets across 10 blockchains, with most transferred within about 20 minutes.
TRM Labs said preparations for the attack began at least 36 hours before the theft, with the attackers using Tornado Cash, a cryptocurrency mixing service, to fund their…
Read More: What we know and what comes next