Binance Suffers $6.3 Billion Hack, the Largest Crypto Theft on Record
An attacker drained Binance wallets across ten blockchains in about 20 minutes Thursday. Binance froze about $3 billion, paused withdrawals, and says it will cover all losses.
Binance, the world’s largest cryptocurrency exchange, said a security breach Thursday had an estimated impact of about $6.3 billion. That would make it the largest cryptocurrency theft on record, more than four times the $1.5 billion taken from the Bybit exchange in February 2025.
Blockchain intelligence firm TRM Labs put the total higher, at about $6.36 billion. It said an attacker moved the funds out of Binance wallets on ten blockchains, most of it in about 20 minutes. The blockchains included Bitcoin, Ethereum, Tron, Ripple and several smaller networks.
Binance said it worked with blockchain partners to freeze affected assets. About $3 billion has been frozen so far, the company said. It gave no update on the remaining $3.3 billion.
How it happened
Binance said its initial investigation pointed to a compromised laptop belonging to a DevOps engineer. The attacker used it to gain access to a service container and submit unauthorized withdrawal transactions, the company said. A later investigation found additional points of breach.
The company said it found no evidence that wallet private keys leaked. Private keys are the unique authorizations that control a crypto wallet. Binance said it would release more technical details when its investigation is complete.
The breach raised a question about the exchange’s internal controls. “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,” said Kok Tin Gan, co-founder and chief executive of cybersecurity firm NyxLab. Hot wallets are connected to the internet, unlike offline cold storage.
The North Korea link
TRM attributed the attack to TraderTraitor, which it described as North Korea’s elite hacking unit. The firm said it made that judgment “with high confidence” and that several features of the attack matched earlier North Korea-linked heists, including the Bybit hack.
Chainalysis, another blockchain analysis firm, reached a similar view. Its co-founder and chief executive, Jonathan Levin, wrote that the hack was “likely done by DPRK group TraderTraitor.” DPRK stands for the Democratic People’s Republic of Korea, North Korea’s official name.
Neither finding is a government conclusion. Binance has not named an attacker. A company spokesperson said only that Binance is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.” Reuters reported Friday that the FBI and the U.S. Secret Service are working with Binance, citing a person familiar with the situation.
Experts say North Korea has turned to crypto hacking as a source of foreign currency to support its economy and fund its nuclear program, in the face of United Nations sanctions. The FBI said North Korea and TraderTraitor were responsible for the Bybit theft last year.
What users face
Withdrawals from Binance are suspended while the company overhauls the security of its withdrawal service. The company said it expects withdrawals to resume within 48 hours. Deposits were not affected, Binance said.
Binance co-founder Yi He said the company would cover “all hacking losses.” Founder Changpeng Zhao, who stepped down as chief executive in 2023 after pleading guilty to a felony linked to failing to prevent money laundering on the platform, wrote on X that “User funds are safe!” and that, as a shareholder, he expects all user funds to be fully covered.
Binance also maintains an emergency reserve called the Secure Asset Fund for Users, created in 2018. Reuters reported the fund holds crypto assets worth roughly $1 billion, entirely in bitcoin. That alone would not cover a $6.3 billion loss, so the rest would have to come from the company’s own funds and recovered assets.
Crypto prices fell on the news. Bitcoin dropped about 3 percent to a six-week low, and ether fell more than 3 percent, according to Reuters. Binance’s own token fell more than 8 percent in 24 hours at one point Friday.
What happens to the unfrozen funds is now the open question. Blockchain firms are still tracing the stolen crypto, and Binance said Friday it was beginning to recover assets for users. Until the remaining $3.3 billion is accounted for, the full cost of the largest crypto heist on record is still unknown.
