Key Takeaways
- • Binance said on Thursday that attackers stole about $6.3 billion in assets, which would be the largest crypto theft on record, according to the exchange and security experts.
- • About $3 billion of the affected assets have been frozen, including more than $2.3 billion in USDT and USDC, with Tether freezing over $1.57 billion in USDT and Circle freezing over $800 million in USDC.
- • Binance's early investigation points to a compromised laptop belonging to a DevOps engineer, and the exchange has found no evidence that wallet private keys were leaked.
- • Binance says it will cover all losses using its Secure Asset Fund for Users (about $1 billion in bitcoin) and company funds, and expects withdrawals to reopen within 48 hours.
- • Bitcoin fell 4.8% to below $77,000 and ether fell 5.7%, while security firms including TRM Labs point to North Korea-linked groups, with TRM citing TraderTraitor.
Summary
Binance, the world's largest crypto exchange by volume, said on Thursday that attackers stole about $6.3 billion in assets, a loss that security experts are describing as the biggest crypto hack in history. The exchange said roughly $3 billion of the affected assets has been frozen, including more than $2.3 billion in USDT and USDC. Tether froze over $1.57 billion in USDT and Circle froze over $800 million in USDC. Binance said it is working with law enforcement to identify the attackers, who have not been named.
Binance's early investigation points to a compromised laptop belonging to a DevOps engineer, which the exchange said may have allowed an attacker to reach a service container and submit unauthorized withdrawals. Binance said it found no evidence that wallet private keys were leaked and plans to publish a detailed technical report once facts are verified. Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction, one of which matched the account's required nonce, and that the affected account was then linked to an unverified contract that allowed tokens and ether to be drained. Blockaid CEO Ido Ben-Natan said the attack looked like a compromise of signing systems and was "very, very similar" to the February 2025 Bybit attack.
Several security groups said North Korea was likely responsible. TRM Labs said it traced the attack to a group called TraderTraitor with "high confidence," and investigator ZachXBT named the Lazarus Group as the likely attacker. Arkham data showed the hacker's wallets once held more than $5.7 billion, including nearly $1.5 billion in bitcoin and $900 million in ether, with funds later seen moving through Uniswap. The attacker also borrowed at least 20,000 wrapped ether, worth about $44 million, on Aave, using stolen USDT as collateral.
Crypto markets reacted sharply. Bitcoin dropped 4.8% to below $77,000, ether fell 5.7%, BNB fell 8%, and AAVE fell 11%. According to DefiLlama, Binance held about $144 billion in assets before the hack, meaning the stolen funds represent roughly 4% of that total.
Binance co-CEO Yi He said the exchange will cover all losses through its Secure Asset Fund for Users and company funds, and founder Changpeng Zhao said user funds are safe. Binance suspended deposits and withdrawals while it runs security checks, and Yi He said she expects withdrawals to reopen within 48 hours. The exchange also promised to publish an updated Proof of Reserves.
Binance's early investigation points to a compromised laptop belonging to a DevOps engineer, which the exchange said may have allowed an attacker to reach a service container and submit unauthorized withdrawals. Binance said it found no evidence that wallet private keys were leaked and plans to publish a detailed technical report once facts are verified. Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction, one of which matched the account's required nonce, and that the affected account was then linked to an unverified contract that allowed tokens and ether to be drained. Blockaid CEO Ido Ben-Natan said the attack looked like a compromise of signing systems and was "very, very similar" to the February 2025 Bybit attack.
Several security groups said North Korea was likely responsible. TRM Labs said it traced the attack to a group called TraderTraitor with "high confidence," and investigator ZachXBT named the Lazarus Group as the likely attacker. Arkham data showed the hacker's wallets once held more than $5.7 billion, including nearly $1.5 billion in bitcoin and $900 million in ether, with funds later seen moving through Uniswap. The attacker also borrowed at least 20,000 wrapped ether, worth about $44 million, on Aave, using stolen USDT as collateral.
Crypto markets reacted sharply. Bitcoin dropped 4.8% to below $77,000, ether fell 5.7%, BNB fell 8%, and AAVE fell 11%. According to DefiLlama, Binance held about $144 billion in assets before the hack, meaning the stolen funds represent roughly 4% of that total.
Binance co-CEO Yi He said the exchange will cover all losses through its Secure Asset Fund for Users and company funds, and founder Changpeng Zhao said user funds are safe. Binance suspended deposits and withdrawals while it runs security checks, and Yi He said she expects withdrawals to reopen within 48 hours. The exchange also promised to publish an updated Proof of Reserves.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.