After hackers stole more than
, the cryptocurrency exchange said Friday it was working to recover the assets, a multi-pronged process that experts said involves coordinating with law enforcement and tracking the movement of the stolen funds.
asserted
experts → steal → funds
"Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds," a Binance spokesperson said in a statement to CBS News.
asserted
spokesperson → begin → News
Ari Redbord, a former federal prosecutor and the global head of policy at TRM Labs, a blockchain intelligence company tracking the stolen funds, called the heist the "largest bank robbery in human history."
asserted
Redbord → track → history
TRM and other security firms attributed the attack to an elite hacking unit linked with North Korea known as "TraderTraitor."
asserted
TRM → attribute → TraderTraitor
The funds were siphoned from internet-connected wallets on Binance's trading platform, Redbord said.
asserted
Redbord → siphon → platform
The entire operation took roughly 20 minutes, according to Binance.
uncertain
operation → take → Binance
"The way a cryptocurrency exchange works is basically just like a bank.
asserted
exchange → work → bank
People put their funds in the bank, and those funds go onto wallets that are controlled by the exchange," Redbord told CBS News.
asserted
Redbord → put → News
"What North Korea was able to do was breach the hot wallets where Binance was keeping all of those funds.
asserted
Binance → do → funds
"
As it works to recover the stolen assets, Binance vowed in a social media post to cover the full losses using company funds.
asserted
Binance → work → funds
"We will pursue all available avenues to identify those responsible and hold them accountable," said Binance, whose U.S. headquarters are in Miami.
asserted
headquarters → pursue → Miami
How does the recovery process work?
asserted
process → work → ?
Redbord called the effort to recover Binance customers' funds the "fastest and largest" he's ever seen.
asserted
he → call → funds
The first step involved blocking the hackers from transferring the funds.
asserted
step → involve → funds
Within an hour after the attack, stablecoin issuers Circle and Tether froze $2.4 billion in assets, he said.
asserted
he → freeze → assets
Ripple and World Liberty Financial, the Trump family's crypto venture, also froze assets, according to TRM Labs.
uncertain
Ripple → freeze → Labs
Issuers of stablecoins — a type of cryptocurrency pegged to a stable asset, such as the U.S. dollar — can block transfer of their tokens anywhere in the world, speeding the recovery effort.
asserted
Issuers → peg → effort
A total of $3 billion in crypto assets have been frozen, the Binance spokesperson told CBS News.
asserted
spokesperson → freeze → News
However, roughly $2.4 billion in stolen funds consisted of bitcoin and ether — those funds are now "beyond any issuer's reach," according to a blog post from TRM Labs.
uncertain
funds → steal → Labs
Bitcoin and ether "move on public blockchains, and they cannot be frozen," Redbord said.
asserted
Redbord → move → blockchains
"That is a very, very specific capability that [only certain] stablecoin issuers have.
asserted
issuers → have → that
The best shot at recovering those funds is if the thieves try to convert the crypto to regular currencies, including cash, he added.
asserted
he → recover → cash
In a social media post, Binance said that an initial investigation suggested the incident may have involved a compromised laptop, while a subsequent probe uncovered additional "points of breach."
uncertain
probe → say → breach
The cyberattackers are now likely laundering the stolen funds to evade detection by law enforcement, according to Redbord.
uncertain
cyberattackers → launder → Redbord
To recover the frozen funds, stablecoin issuers will start by moving the assets into a wallet that North Korea cannot access, he said.
asserted
he → recover → that
"Law enforcement will follow up with what they call a 'seizure warrant,' which basically says we need you to actually physically transfer these funds to a U.S. government account," Redbord told CBS News.
asserted
Redbord → follow → News
How long could it take to recoup the funds?
After the funds are seized, government officials will have to pursue a civil forfeiture proceeding in court to recover the crypto assets.
"
uncertain
officials → take → assets
The government must show that the funds were associated with the activity at issue," Redbord said.
asserted
Redbord → show → issue
"It is the final step before the funds can be taken permanently from the bad actor and given to the government or victims.
asserted
funds → take → government
Any of the Binance funds that aren't recovered could be used by North Korea to carry out illicit transactions with countries like Russia, Roman Bieda, chief intelligence officer at Recoveris, a Swiss blockchain intelligence company, told CBS News.
uncertain
Bieda → recover → News
"Freezing assets and recovering them are two very different things," he said.
asserted
he → freeze → them
"North Korea has a history of using stolen cryptocurrency to circumvent international sanctions and finance its activities.
asserted
Korea → have → activities
In 2025, TraderTraitor also targeted another crypto exchange, Bybit, in an attack resulting in a $1.5 billion loss, according to the FBI.
uncertain
TraderTraitor → target → FBI
Given the scale of the theft, however, it's unclear how long it could take Binance to recoup the stolen assets.
uncertain
it → give → assets
In one case, his team worked on a scam for a Swiss client that took 14 months to recover $10.5 million in crypto assets, Bieda said.
asserted
Bieda → work → assets
"The process remains unpredictable," he said in an email, emphasizing the close coordination required between law enforcement, crypto issuers and other stakeholders to track down the funds.
asserted
he → remain → funds
Figuring out where the money went is only half the battle, he said.
asserted
he → figure → ?
"Knowing whom to contact and reaching them before the assets move again can make all the difference, and this is really challenging," Bieda said.
asserted
Bieda → know → difference
The Aporia
