Finance and AI investigation firm TRM Labs has attributed the Binance incident to a North Korean hacking unit called TraderTraitor.

"We make this judgment with high confidence," TRM said in a report, adding that several elements of the attack resemble earlier North Korean-linked incidents, including 2025's Bybit hack.

The lab's chief policy officer Ari Redbord told the BBC the Binance hack is a "watershed moment" that is unlike anything the industry has seen.

The attacker still holds an enormous sum of stolen assets, meaning efforts to trace and recover the funds are far from over, Redbord added.

Binance did not directly respond to BBC queries about potential links to North Korea but said: "We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice."

Two other major crypto platforms, Tether and Circle, said they have also frozen a total of about $2.4bn of assets in response to the potential Binance hack.

Circle chief executive Jeremy Allaire said his firm is "closely tracking reports of a potential exploit involving Binance" and that his company has frozen more than $800m in assets linked to the incident.

Circle is the issuer and co-creator of the USDC, one of the world's largest US dollar-backed cryptocurrencies.

Tether CEO Paolo Ardoino said his firm has frozen around $1.6bn "related to a potential Binance exchange hack."

"Protecting the industry and our partners is our main priority," said Ardoino, whose company issues a cryptocurrency known as USDT.

World Liberty Financial, a crypto company linked to US President Donald Trump and his family, said it has worked with its partners to freeze stolen funds.

Crypto exchange Coinbase said it was unaffected by the incident and was monitoring the situation.

Several crypto industry observers had flagged concerns about a potential hack on Binance hours before the exchange confirmed the security issue.

Binance, which was founded in China by Zhao in 2017, allows users to trade digital assets and is estimated to have more than 300 million registered users worldwide.

The exchange has been subject of regulatory scrutiny around the world.

The company said in 2024 that it has more than $160bn in assets under custody.