- Binance suffered the biggest crypto hack ever. The exchange estimated the impact at $6.3 billion, with around $3 billion in crypto assets frozen so far, and pledged to cover all losses using its Secure Asset Fund for Users and company funds.
- An employee laptop was the entry point. Binance said its initial investigation suggests a compromised DevOps engineer’s laptop let an attacker reach a service container and submit unauthorized withdrawals, and that it found no evidence of any wallet private key leak.
- North Korea is the prime suspect. TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored unit, and Chainalysis also assessed the $6.4 billion hack was likely its work.
- Stablecoin issuers moved fast. Tether froze more than $1.5 billion of USDT and Circle froze more than $800 million of USDC, while Circle shares fell about 5% after hours Thursday.
What Happened?
Binance temporarily suspended deposits and withdrawals, revoked the affected address authorization and brought in law enforcement and blockchain intelligence firms. Co-founder Yi He said deposits were unaffected and that the exchange expects to begin resuming withdrawals within 48 hours. TRM Labs estimates about $6.36 billion was moved from Binance wallets across 10 blockchains, most of it within about 20 minutes, and said preparations began at least 36 hours earlier, with the attackers funding wallets through the Tornado Cash mixer.
Why It Matters?
The theft is about four times the $1.5 billion Bybit hack in February 2025, which the FBI attributed to the same group, and equals roughly 4% of the $144 billion Binance held before the breach, according to DefiLlama data. Fundstrat’s Sean Farrell said the attack “does not currently appear to create meaningful solvency risk,” estimating about $3.3 billion remains unfrozen and that the roughly $1.2 billion SAFU fund could cover about a third of it, with the rest from Binance’s own funds.
What’s Next?
Recovery is the next test. TRM Labs’ Ari Redbord said frozen stablecoins are “the most recoverable asset class in crypto” because issuers can freeze, burn and reissue them, while stolen bitcoin and ether must be traced through exchanges. Farrell said the key tell will be “how quickly withdrawals resume and whether outflows stay orderly,” and Binance has promised a technical post-mortem and an updated proof of reserves.
