Photo: Bxalber / Wikimedia Commons, CC BY-SA 4.0
Hackers made off with about $6.3 billion from Binance, the world’s largest cryptocurrency exchange, the company confirmed on Friday, more than double the amount it had first reported frozen and enough to make the attack the biggest crypto theft ever recorded. Blockchain analysis firms say the trail points to North Korea, and US federal agencies are now involved in tracking the money.
Twenty minutes, several blockchains
Most of the funds left Binance’s internet-connected “hot” wallets in a burst of roughly 20 minutes late on Thursday, spread across several blockchains and including bitcoin, ether and the dollar-pegged stablecoins USDT and USDC. Binance first said the breach may have started with a compromised laptop belonging to a DevOps engineer, which gave the attacker a way into a service container to submit unauthorised withdrawals.
By Friday afternoon the company had widened that account. Co-CEO Richard Teng said the attack was complex and not the work of one person, with additional points of breach beyond the laptop. He said the attackers manipulated a system used to approve transactions so that money moved out without passing through normal controls, and used malicious software that deleted their tools and traces as they went, making the investigation harder.
Who pays for the loss
Binance says customers will not lose money. It has set aside more than $6.34 billion of company funds to restore balances, including about $5 billion already held in the exact tokens that were stolen, and is buying the rest on public markets and over the counter. The exchange also runs a $1 billion bitcoin reserve fund meant for security breaches.
We NEVER use any customer funds, so they are not impacted.
Richard Teng, Binance co-CEO, on X
About $3 billion of the stolen assets has been frozen so far, much of it by stablecoin issuers: Tether said it had locked nearly $1.57 billion and Circle more than $800 million. Deposits are working again, and Binance said it expects to restart withdrawals within about two days. It has promised an updated proof of reserves once the clean-up is done.
North Korea suspected, FBI and Secret Service step in
TRM Labs and Chainalysis both said they had high confidence that North Korean hackers, the group known as TraderTraitor or Lazarus, were behind the attack. TRM said the method, in which the exchange’s own wallets were instructed to empty into attacker-controlled addresses, mirrors the $1.5 billion Bybit heist of 2025 that the FBI blamed on Pyongyang. North Korea has always denied carrying out such thefts.
The FBI said it was aware of the incident and working with public and private partners. The US Secret Service said it was working around the clock to identify, freeze, trace and recover the funds, in coordination with federal prosecutors in Washington, DC.
Why it matters
The haul is more than twice the roughly $2.9 billion that TRM Labs estimates was stolen across nearly 150 crypto attacks in all of last year. Binance, which has more than 300 million registered users, says it is strong enough to absorb the hit, but some market watchers have noted that FTX gave similar assurances before it collapsed in 2022. Whether withdrawals restart on schedule, and how much of the remaining $3.3 billion can be recovered, will be the key tests in the coming days.
