Binance, the world’s largest cryptocurrency exchange, said late Thursday that a major security incident had an estimated total impact of about $6.3 billion — in what analysts say is the largest crypto theft on record.
Cryptocurrencies were siphoned from Binance wallets across multiple blockchains in what founder Changpeng Zhao said appeared to be a hack.
Binance said its initial investigation found that the security incident may involve a compromised DevOps engineer’s laptop, allowing a hacker to gain access to a service container and submit unauthorized withdrawal transactions. It found no evidence of any wallet private key leak.
People were interested in these podcasts
“We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified,” Binance said in a statement.
The attacker moved the billions of dollars out of Binance wallets on ten blockchains, most of it in about 20 minutes starting around 4 p.m., according to an analysis by crypto tracing firm TRM Labs.
That makes this the largest crypto theft on record, about four times the $1.5 billion Bybit hack in February 2025, it said.
TRM attributed the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on- and off-chain intelligence.
“We make this judgment with high confidence,” it said. “TRM is tracking the funds and alerting partners through the Beacon Network.”
The company first acknowledged the incident at 6:15 p.m. Thursday.
By 7 a.m. Friday, Binance said it had begun recovering affected assets for users.
“User funds remain safe,” Binance said in a statement. “User funds remain safe. As a precaution, all deposits and withdrawals are temporarily suspended while our security teams conduct checks, secure wallet infrastructure, and trace affected assets, with the close support of our law enforcement and industry partners.”
Binance also revoked the affected address authorization and engaged law enforcement and blockchain intelligence partners to trace and recover funds.
“Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice,” the company said.
Binance said it has already reserved over $6.34 billion of company funds to cover this incident, $5 billion of which are “already held in the exact token assets that were impacted.”
This does not include frozen or protected assets, it added, which remain subject to ongoing recovery and verification.
“We are completing the purchase of the remaining amount by buying token assets through market channels and [Over-the-Counter] channels. We are doing this to match the format of the remaining token assets and address any asset shortfalls,” Binance said. “This step can take longer because some tokens may have low liquidity and OTC settlement also takes time.”
Contact the author
Please read our comment policy before commenting.