A Binance crypto heist drained about $6.3 billion from the world’s largest crypto exchange, in what The Verge calls the biggest cryptocurrency hack on record. Binance says user funds are safe and that it will cover all losses from an emergency fund and company funds. Partners have frozen about $3 billion, withdrawals stay paused, and TRM and Chainalysis attribute the attack to North Korea; Binance has not named a culprit.
Key Takeaways
- Hackers stole about $6.3 billion from Binance, the largest crypto heist on record.
- TRM and Chainalysis blame North Korea’s TraderTraitor hacking group.
- Binance says user funds are safe and will cover every loss.
- About $3 billion is frozen; deposits are back, withdrawals are not.
How the Binance Crypto Heist Unfolded
Most of the theft happened in about 20 minutes late Thursday, TRM Labs and Chainalysis found, Al Jazeera reported. TRM said an attacker moved approximately $6.36 billion out of Binance wallets on 10 blockchains. Decrypt, citing Arkham, put a separate tally at $6.01 billion from hot wallets on nine blockchains between 4:10 p.m. and 7:05 p.m. ET.
Binance first pointed to a compromised laptop belonging to a DevOps engineer, which may have allowed access to a service container and unauthorized withdrawal transactions. On Friday it said the investigation had found more. On X, the exchange reported:
Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it.
Co-CEO Richard Teng said the attacker “did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action” and that it “involved a more complex attack process.” The probe “has not attributed responsibility to any individual.” He also said, “So far, we have found no evidence of any wallet private key leak.” Binance revoked the affected address’s authorization.
Analysts Name TraderTraitor; Binance Does Not
TRM assessed with “high confidence” that TraderTraitor, linked to the Lazarus Group, carried out the attack. Chainalysis agreed. TRM said the attackers ordered Binance wallets to empty into wallets they controlled, mirroring the Bybit hack.
The FBI blamed that unit for the 2025 Bybit theft. The Verge put Bybit at $1.46 billion and called this heist four times higher; Al Jazeera reported $1.5 billion in February 2025.
Experts say the stolen coins have become a foreign-currency source for Pyongyang, including funding a nuclear programme under United Nations sanctions. North Korea routinely denies involvement in hacking. Ari Redbord, TRM’s global head of policy, said: “When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity.” He added, “That makes this a global security issue, not just a crypto theft.”
What Was Frozen, and Who Covers the Loss
Tracer totals still disagree. These are the figures the outlets actually published:
| Estimate | Amount | Reported by |
|---|---|---|
| Binance impact estimate | $6.3 billion | Binance, via The Verge |
| TRM on-chain tally | $6.36 billion | TRM, via Al Jazeera |
| Arkham hot-wallet tally | $6.01 billion | Arkham, via Decrypt |
| Assets reported frozen | About $3 billion | Binance |
| Bybit record | $1.46 billion | The Verge |
Binance said about $3 billion is frozen, including more than $2.3 billion by Tether and Circle, according to the Reuters news agency, Al Jazeera reported. Arkham counted $2.80 billion frozen by issuers and about $2.9 billion in Ethereum, Bitcoin, Tron, Solana and other tokens that could still move. Binance has not stated what happened to the remaining $3.3 billion, and it warned the $6.3 billion figure “may continue to increase.”
The Verge reported an emergency reserve of about $1.3 billion at last valuation, and more than $6.34 billion in company funds reserved, $5 billion of it “already held in the exact token assets that were impacted.” Al Jazeera described SAFU, a Bitcoin fund set up in 2018 and held entirely in Bitcoin, as a $1 billion emergency fund, and said the theft is more than six times that sum. Decrypt said Binance will cover all losses from the SAFU fund and company funds. Teng wrote: “Bottom line – your money is safe, and we’re covering every loss.”
What the Theft Means for Holders
Prices fell, then steadied. Bitcoin hit a six-week low of $76,368, and Ether fell more than 3 percent to a two-month low of $2,178. Coinbase shares dropped 4.8 percent even though that exchange said it was unaffected. Analysts told Reuters the market was already under pressure from higher US interest rates and weaker demand from exchange-traded fund buyers.
For holders, the weak point is custody. Sean Foley of Macquarie University told Al Jazeera: “Any assets held at a centralised exchange are only as safe as the exchange itself, and the larger the exchange’s holdings, the larger a target it becomes.” Most crime- and cyber-insurance policies do not cover stolen cryptocurrency, Al Jazeera noted.
- Deposits were “operating as normal” by Friday morning, Teng said.
- Withdrawals remain suspended for a security revamp; Binance said it is on track to resume them within 45 hours.
- Teng said a verified post-mortem and an updated Proof of Reserves will follow.
