Binance says $6.3 billion was hit in record crypto theft
The exchange says it will cover customer losses after partners froze roughly $3 billion tied to the attack.
About $3 billion in assets tied to the Binance breach has been frozen, leaving another roughly $3.3 billion caught up in what the exchange says was a complex attack.
Binance, the world's largest cryptocurrency exchange, says the total impact was about $6.3 billion, making it the largest reported crypto theft on record. The prior record was the roughly $1.5 billion stolen from Bybit in 2025. Binance has pledged to cover customer losses from its emergency reserve and company funds.
How it started: Binance's initial investigation said a compromised laptop belonging to a DevOps engineer may have given an attacker access to a service container, allowing unauthorized withdrawal transactions. The company later said it found additional breach points and that this was not simply one employee clicking one bad link. It says it has found no evidence that wallet private keys were leaked.
The money trail: Circle froze more than $800 million in USDC associated with the incident, and Tether froze more than $1.5 billion in USDT. Binance says it has worked with issuers, law enforcement and blockchain intelligence firms to freeze about $3 billion on-chain. A freeze stops some funds from moving, but returning them requires a separate legal process. Crypto, as ever, has discovered that moving money fast and getting it back are different jobs.
Who did it: TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean hacking group, with TRM saying an attacker moved about $6.36 billion across 10 blockchains, mostly in about 20 minutes. Binance has not attributed the breach to anyone, and the U.S. government was still investigating Friday.
Binance temporarily suspended withdrawals during its response. Early reports said deposits were also paused, while later Binance updates said deposits were operating normally and withdrawals were expected to resume by Sunday. The thing to watch is whether the exchange can restore withdrawals on that timeline while tracing the assets that are still moving.
The world's most important stories. Explained clearly. Delivered daily.
- Every morning
- Five-minute read
- Unsubscribe anytime