WORLDTECHBinance halts withdrawals after breach blamed on North Korean group TraderTraitor
Binance, a cryptocurrency exchange and financial services company based in the United Arab Emirates, suspended all withdrawals after a breach that drained funds across more than ten blockchains. TRM Labs, Chainalysis and the FBI link the attack to TraderTraitor, a North Korean hacking group, according to Crypto Briefing.
How the draining played out
Per the report, the draining of assets lasted somewhere between 20 and 30 minutes. The intrusion reached the largest crypto exchange in the world across more than ten blockchains, and Binance responded by halting every withdrawal.
Binance released an initial incident report on November 3, 2026. That document portrayed the event as a protracted operation involving malware and sophisticated laundering techniques rather than one quick raid. The initial opening was reportedly human rather than technical: the attackers relied on social engineering, including bogus job interviews targeting Binance engineers, to obtain access from within.
Freezes and compensation
Binance coordinated with stablecoin issuers Tether, which issues USDT, and Circle, which issues USDC, to immobilise roughly $3 billion of the stolen money. The exchange additionally earmarked more than $6.34 billion of its own funds to make users whole.
Services came back in stages instead of all at once, the reporting says.
Why freezable tokens made a difference
Stablecoins such as USDT and USDC are issued by firms that can block specific addresses, and in this instance that capability kept roughly $3 billion beyond the attackers' reach. Yet around half of the stolen assets were shifted into tokens lacking any central freezing function, and once funds arrive there, no issuer holds a switch able to halt them.
Tokenised securities, which represent traditional assets as tradable entries on a blockchain, follow a comparable logic, with issuers generally retaining administrative control over who may hold or move them. Crypto Briefing contends that the episode underlines the pressing need for tighter security measures and regulatory frameworks to protect tokenised assets worldwide.
A persistent state-linked threat
Per the report, North Korean groups such as TraderTraitor are state-sponsored, and their campaigns against digital asset platforms have turned into an ongoing threat.
Open questions
- Which blockchains and tokens besides the stablecoins were touched by the drain?
- Will Binance's continuing investigation substantiate the social-engineering details in its initial report?