The Binance logo is displayed on a screen in San Anselmo, California, June 6, 2023.

Justin Sullivan | Getty Images

Binance was hacked with an estimated impact of $6.3 billion, raising questions about the recovery of stolen funds and the broader fallout for crypto markets. Around $3 billion in cryptocurrency assets have been frozen so far.

The exchange pledged to cover all losses, while blockchain investigators linked the attack to North Korea and analysts assessed the potential financial risks.

Bitcoin was under pressure on Friday and was trading below $78,000.

watch now

Freezing cryptocurrency prevents it from being transferred, but recovering the funds requires a separate legal process, according to Ari Redbord, global head of policy at blockchain intelligence firm TRM Labs and a former U.S. federal prosecutor and Treasury official.

"A freeze stops the money from moving, and recovery follows through legal process," Redbord told CNBC.

Redbord said law enforcement typically obtains a court order or seizure warrant before working with stablecoin issuers to release or reissue assets and return them to their rightful owners.

"Stablecoins are the most recoverable asset class in crypto because the issuer controls the token contract," he said. "Tether and Circle can freeze, burn and reissue, which allows frozen USDT and USDC to be returned to a victim."

But recovering bitcoin and ether is more challenging because they have no issuer that can directly freeze the assets. Instead, investigators must trace funds through exchanges and other crypto services where they can potentially be intercepted, added Redbord.

Eric Jardine, head of research at blockchain analytics firm Chainalysis, said returning frozen assets requires coordination among law enforcement, exchanges and token issuers.

"There is no standard recovery timeline. A technical freeze may happen quickly, while returning funds can take months or years," Jardine told CNBC.

Jardine added that while bitcoin and ether cannot be frozen by an issuer, they can still be traced and potentially recovered. Investigators can trace the funds on public blockchains and intervene when they reach a cooperating exchange or another centralized platform, he said.

TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, based on on-chain and off-chain intelligence.

The FBI previously identified the same group as responsible for the $1.5 billion Bybit hack in February 2025, according to the company's insights.

TRM Labs said the Binance attack shared characteristics with previous North Korea-linked incidents, including preparations made well before the theft and transaction signatures obtained in advance.

The firm estimated that approximately $6.36 billion in digital assets were moved from Binance wallets across 10 blockchains, with most transferred within about 20 minutes.

TRM Labs said preparations for the attack began at least 36 hours before the theft, with the attackers using Tornado Cash, a cryptocurrency mixing service, to fund their wallets ahead of the breach.

Chainalysis also pointed to North Korea, with co-founder and CEO Jonathan Levin saying the firm assessed that the $6.4 billion Binance hack was likely carried out by TraderTraitor, citing links to previous attacks.

The attack does not currently appear to pose a significant solvency risk for Binance, according to Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors.

"The most important takeaway for markets is that this does not currently appear to create meaningful solvency risk for Binance," Farrell said.

Farrell estimated that around $3.3 billion in assets remained unfrozen. Assuming frozen stablecoins are eventually returned, Binance's SAFU emergency fund, worth approximately $1.2 billion, could cover roughly a third of the remaining losses, with the balance coming from the exchange's own funds.

Farrell said the key indicators to watch were how quickly Binance resumes withdrawals and whether outflows remain orderly. He added that a shortfall in customer assets could force the exchange to sell reserves, potentially triggering broader selling across crypto markets.

"I do not think that is the setup we are dealing with, but the key tell will be how quickly withdrawals resume and whether outflows stay orderly," Farrell said.

The Binance hack underscores the need for stronger cybersecurity standards and greater coordination among governments, according to Chris Perkins, head of Franklin Crypto at Franklin Templeton.

Speaking to CNBC's "Squawk Box Asia," Perkins said the industry must address cybersecurity challenges to reach its full potential, calling for stronger defenses and policies to hold cybercriminals accountable.

watch now

"We need to make sure standards are incredibly high, but we have to really focus on the criminals," Perkins said.

Perkins called for greater international cooperation to address cybersecurity threats, pointing to regulatory coordination among G20 countries following the global financial crisis as a potential model.

He also said AI could help improve cybersecurity by identifying and addressing vulnerabilities, even as the technology is used by both attackers and defenders.

Extracted and lightly reformatted for readability. · Source: pt