Luckily for Binance, Tether and Circle quickly began freezing some of the exploiter's wallets. Tether froze at least $1.567 billion of the roughly $1.768 billion in stolen USDT, and Circle froze around $800 million of the $823 million in USDC. Binance estimated that $3 billion in total was frozen, though some other networks that have frozen assets are preventing the attacker from cashing out, but may not be able to easily restore them to Binance.
Binance founder Changpeng Zhao, who is not legally allowed to run the exchange yet seems to remain very closely aware of its inner workings, posted early estimates of the freezes and wrote, "I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." He later added, "Loss might be a bit higher than [$1 billion], but will cover." Binance later disclosed that they believed the exploit occurred after a devops employee's laptop was compromised.
Blockchain security firm TRM Labs subsequently attributed the attack to TraderTraitor, a North Korean state-sponsored cybercrime group also known as the Lazarus Group. They have been behind many of the largest cryptocurrency thefts, including the now second-largest hack of all time: the 2025 theft of $1.5 billion from the Bybit exchange.
