Cryptocurrency exchange Binance confirmed on Thursday that a suspected security breach affected roughly $6.3 billion in digital assets, marking the largest theft in the sector’s history. The Binance crypto heist triggered emergency countermeasures across the industry after blockchain intelligence firms linked the multi-billion-dollar raid to North Korean state-sponsored hackers.
Key points
- Binance reported an estimated $6.3 billion impact across hot wallets spanning the Bitcoin, Ethereum and Tron blockchains.
- Stablecoin issuers, custodians and decentralised protocols coordinated to freeze roughly $3 billion of the moved tokens on-chain.
- Blockchain analytics firms TRM Labs and Chainalysis attributed the attack to North Korean cyber warfare unit TraderTraitor.
- Binance suspended customer withdrawals while auditing internal systems, pledging to cover all losses through corporate funds and its emergency reserve.
How the funds left the exchange
Unusual activity surfaced late Thursday when independent blockchain monitors observed several billion dollars moving rapidly out of Binance hot wallets. Exchanges rely on internet-connected hot wallets to process customer deposits and routine withdrawals. While those wallets are essential for day-to-day liquidity, their live network connections create exposure if administrative credentials fail.
Transfers drained digital tokens across several independent networks. Drained reserves included 18,270 Bitcoin valued at roughly $1.44 billion, alongside $3.51 billion in Ethereum ecosystem tokens and $630 million routed through the Tron blockchain. The perpetrator also moved sums in Solana, Tether’s USDT and Circle’s USDC into freshly created holding addresses.
On-chain records showed an Ethereum transaction at 20:24 UTC that transferred 167,464 Ether to an unrecognised destination alongside 63 separate token transfers, including approximately $1.615 billion in USDT. Three minutes before that transfer, an address funded through the crypto-mixing service Tornado Cash submitted a delegation request against a Binance hot wallet.
The attackers used EIP-7702, an Ethereum standard designed to let regular accounts execute smart-contract functions on a temporary basis. Investigators are examining how the party behind the exploit obtained the digital signature needed to authorise that delegation.
The incident followed growing scrutiny of exchange balances, coming shortly after an earlier Binance hack investigation looked into unusual volume patterns across intermediate trading pools.
The compromised DevOps laptop
Binance published preliminary findings indicating that the breach began through an employee’s computer rather than a fundamental flaw in blockchain cryptography. The company said an attacker gained access to a DevOps engineer’s laptop, using that foothold to reach internal service containers and generate unauthorised withdrawal commands.
The company said it found no evidence that wallet private keys were leaked or decrypted. It revoked the network permissions granted to the attacker’s wallet addresses and halted trading on Binance Alpha, a venue for early-stage crypto tokens, before pausing all withdrawals across the primary exchange.
Binance co-chief executive Richard Teng told users their money was safe and promised the exchange would absorb the full financial impact. Yi He, the exchange’s co-founder and co-chief executive, confirmed that customer accounts would not bear the cost of the theft.
“Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe,” Binance wrote in a blog post detailing its remediation plan.
The Secure Asset Fund for Users, or SAFU, serves as an emergency insurance pool established by Binance to shield customers from catastrophic security incidents. Stored entirely in Bitcoin, the fund held about $1 billion earlier in October, with a policy to replenish reserves whenever they fall below $800 million. Covering the full unrecovered sum will require significant extra capital from Binance’s corporate reserves if missing assets cannot be retrieved.
Changpeng Zhao, the Binance co-founder who stepped down as chief executive in 2023 following a US money-laundering settlement, addressed the breach on X. Zhao said the incident appeared to be a hack and said that as a shareholder, he expected all customer balances to receive full compensation.
North Korean intelligence links
Two separate blockchain forensics firms attributed the theft to TraderTraitor, an elite hacking unit operated by North Korean intelligence. Chainalysis reported high confidence in the link, citing technical fingerprints and transaction structures identical to past state-backed campaigns.
TRM Labs reached the same conclusion after mapping transaction trails across multiple blockchains. Ari Redbord, global head of policy at TRM Labs, told the BBC that the Binance breach was a “watershed moment” that surpassed previous crypto thefts in both speed and monetary volume.
The theft eclipses the previous sector record, a $1.5 billion exploit against Tokyo-based exchange Bybit in 2025 that investigators also linked to North Korean operators. Western intelligence agencies have repeatedly reported that North Korea uses stolen digital assets to finance its ballistic missile and nuclear weapons programmes. The Pyongyang government has consistently denied running state cyber theft operations.
Binance did not name North Korea directly in its public statements. A company spokesperson said the exchange is cooperating with international law enforcement agencies to identify the perpetrators and recover stolen assets.
How the crypto industry froze $3 billion
Because public blockchains display token transfers openly, stablecoin issuers and decentralised platforms tracked the illicit outflows in real time. Several firms blacklisted the receiving addresses within minutes of the initial alerts.
Tether chief executive Paolo Ardoino said his company froze more than $1.567 billion in USDT connected to the suspicious wallets. Circle chief executive Jeremy Allaire confirmed his firm locked more than $800 million in USDC across affected addresses. Centralised stablecoin issuers maintain contract-level controls that can block specific wallets from transferring tokens, stopping those holdings from being sold or swapped.
The attacker attempted to bypass those restrictions by routing funds through decentralised finance. Blockchain records showed the attacker deposited stablecoins into lending protocol Aave before the freeze took effect, borrowing Ether against the collateral. Unlike dollar-backed stablecoins, native Ether has no central issuer capable of blacklisting an address on-chain. Aave responded by halting new deposits and borrowing across its V3 and V4 lending markets.
Other crypto organisations contributed to the containment effort. World Liberty Financial, a digital asset project linked to the family of US President Donald Trump, coordinated with custodian BitGo to freeze $27 million in stablecoins and roughly $2 million in project tokens. Ripple locked approximately $200 million in associated funds.
Market reaction and next steps
The scale of the breach caused widespread price declines across digital asset markets. Bitcoin dropped toward a six-week low of $76,368 on Friday morning, while Ether fell around 2% to $2,238. BNB, the native utility token of the Binance ecosystem, dropped more than 8% to $694. Shares in US exchange Coinbase fell 4.8% in extended trading.
Industry analysts expressed doubt over the recovery of unfreezable digital tokens. Bobby Lee, founder of hardware wallet maker Ballet Global, told Bloomberg Television that Bitcoin moved to external wallets would probably prove impossible to reclaim because node networks cannot censor transactions after confirmation.
The incident adds to an intense period of cyber threats across the sector. Researchers at TRM Labs recorded $2.9 billion in stolen cryptocurrency across nearly 150 attacks last year, followed by a $350 million theft from exchange Bitget in September. An unrelated breach at prediction market Polymarket on Thursday drained $2.6 million through a compromised third-party provider before trading resumed.
Binance reopened customer deposits early on Friday but kept withdrawals paused while engineers conducted an infrastructure overhaul. The exchange told users it expects withdrawal services to resume within 48 hours of the update, adding that it will publish an audited Proof of Reserves report once security teams finish their investigation.
