After hackers stole more than $6 billion from Binance, the cryptocurrency exchange said Friday it was working to recover the assets, a multi-pronged process that experts said involves coordinating with law enforcement and tracking the movement of the stolen funds.
“Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds,” a Binance spokesperson said in a statement to CBS News.
Ari Redbord, a former federal prosecutor and the global head of policy at TRM Labs, a blockchain intelligence company tracking the stolen funds, called the heist the “largest bank robbery in human history.”
TRM and other security firms attributed the attack to an elite hacking unit linked with North Korea known as “TraderTraitor.” The funds were siphoned from internet-connected wallets on Binance’s trading platform, Redbord said. The entire operation took roughly 20 minutes, according to Binance.
“The way a cryptocurrency exchange works is basically just like a bank. People put their funds in the bank, and those funds go onto wallets that are controlled by the exchange,” Redbord told CBS News. “What North Korea was able to do was breach the hot wallets where Binance was keeping all of those funds.”
As it works to recover the stolen assets, Binance vowed in a social media post to cover the full losses using company funds.
“We will pursue all available avenues to identify those responsible and hold them accountable,” the company said.
How does the recovery process work?
Redbord called the effort to recover Binance customers’ funds the “fastest and largest” he’s ever seen. The first step involved blocking the hackers from transferring the funds. Within an hour after the attack, stablecoin issuers Circle and Tether froze $2.4 billion in assets, he said. Ripple and World Liberty Financial, the Trump family’s crypto venture, also froze assets, according to TRM Labs.
Issuers of stablecoins — a type of cryptocurrency pegged to a stable asset, such as the U.S. dollar — can block transfer of their tokens anywhere in the world, speeding the recovery effort. A total of $3 billion in crypto assets have been frozen, the Binance spokesperson told CBS News.
However, roughly $2.4 billion in stolen funds consisted of bitcoin and ether — those funds can’t be frozen and are now “beyond any issuer’s reach,” according to a blog post from TRM Labs.
Bitcoin and ether “move on public blockchains, and they cannot be frozen,” Redbord said. “That is a very, very specific capability that [only certain] stablecoin issuers have.”
In a social media post, Binance said that an initial investigation suggested the incident may have involved a compromised laptop, while a subsequent probe uncovered additional “points of breach.”
The cyberattackers are now likely laundering the stolen funds to evade detection by law enforcement, according to Redbord. The best shot at recovering the remaining funds is if the thieves try to convert the crypto to regular currencies, such as cash.
The next phase will involve recovering the stolen crypto. Working with law enforcement, stablecoin issuers will move the frozen funds into a wallet that North Korea cannot access.
“Law enforcement will follow up with what they call a ‘seizure warrant,’ which basically says we need you to actually physically transfer these funds to a U.S. government account,” Redbord told CBS News.
How long could it take to recoup the funds?
After the funds are seized, Binance, whose U.S. headquarters are in Miami, will have to pursue a civil forfeiture proceeding in court to recover the crypto assets.
Any of the Binance funds that aren’t recovered could be used by North Korea to carry out illicit transactions with countries like Russia, Roman Bieda, chief intelligence officer at Recoveris, a Swiss blockchain intelligence company, told CBS News.
“Freezing assets and recovering them are two very different things,” he said. “North Korea has a history of using stolen cryptocurrency to circumvent international sanctions and finance its activities.”
In 2025, TraderTraitor also targeted another crypto exchange, Bybit, in an attack resulting in a $1.5 billion loss, according to the FBI.
Given the scale of the theft, however, it’s unclear how long it could take Binance to recoup the stolen assets. In one case, his team worked on a scam for a Swiss client that took 14 months to recover $10.5 million in crypto assets, Bieda said.
“The process remains unpredictable,” he said in an email, emphasizing the close coordination required between law enforcement, crypto issuers and other stakeholders to track down the funds. Figuring out where the money went is only half the battle, he said.
“Knowing whom to contact and reaching them before the assets move again can make all the difference, and this is really challenging,” Bieda said.
Disclaimer : This story is auto aggregated by a computer programme and has not been created or edited by DOWNTHENEWS. Publisher: cbsnews.com
