The world’s largest cryptocurrency exchange has been hit by what looks like the biggest crypto theft ever recorded. Binance suspended all deposits and withdrawals after attackers drained billions of dollars from its wallets.
The company said about $6.3 billion in assets was affected by the security incident, which began late on Thursday. It said it has frozen around $3 billion so far and will keep working to trace and freeze more. Chainalysis estimated that roughly $5.9 billion was stolen at the time of the theft, around four times the size of the record-setting Bybit hack of 2025.
How the attack worked
Binance said an initial investigation suggests the attackers gained access through an engineer’s laptop. That allowed them to reach a service container and submit unauthorized withdrawal transactions. Binance said it has revoked the affected address authorizations and brought in law enforcement and blockchain intelligence partners to trace the funds.
Binance’s US arm, Binance.US, was not affected.
Funds frozen and a promise to cover losses
Binance said it will cover all losses using company funds and its emergency reserve, known as SAFU, which holds about $1 billion in bitcoin. It insisted that customer funds are safe. Changpeng Zhao, the co-founder who stepped down as chief executive but remains its largest shareholder, said he expects user funds to be safe.
Stablecoin issuers acted quickly to limit the damage. Tether’s chief executive, Paolo Ardoino, said the company froze more than $1.5 billion of its USDT stablecoin related to the incident. Circle’s chief executive, Jeremy Allaire, said about $800 million of its USDC was frozen. Some decentralized finance platforms also paused lending markets, including Aave and Kamino, to stop compromised funds from flowing in.
Suspected North Korean involvement
Blockchain intelligence firms attributed the attack to TraderTraitor, a hacking unit linked to the Lazarus Group, North Korea’s state-sponsored hackers. TRM Labs and Pangolin Intelligence both pointed to that group, according to media reports. Binance has not commented on who was behind it. Ari Redbord of TRM called the attack “unprecedented” and a watershed moment.
Aravind Srinivasan of crypto market maker GSR told Reuters that it is the biggest hack in history.
Market fallout
Prices dropped quickly. Bitcoin fell as much as 4.5% to about $76,368, its lowest level in six weeks, before recovering to roughly $78,400. Binance’s own token, BNB, dropped 8.6% to near $694 at one point. Ether also fell, though both major coins regained some ground by midday in Hong Kong and traded about 2% to 3% lower.
Analysts said the bigger risk is to confidence. Sean Foley of Macquarie University said a blow to a large centralized exchange can shake retail investors and weigh on prices across the market.
What it means for users
Binance said deposits and withdrawals will resume as soon as security checks are complete. It did not give a timetable. Users with funds on the exchange should watch the company’s official channels and avoid links in unsolicited messages, since scams often follow major incidents.
The hack also revives long-running questions about the security of centralized exchanges, where users hand custody of their assets to the platform. Large holders have increasingly moved coins to self-custody wallets or regulated custodians after earlier breaches. Regulators in several countries are likely to examine how an engineer’s laptop could provide a path into one of the industry’s best-defended systems.
This is a developing story, and the amounts frozen and recovered may change as investigators trace the stolen funds.
