Key Takeaways
- • Binance estimates the total impact of a security breach at about $6.3bn (€5.5bn), with roughly $3bn frozen on-chain so far, according to a statement posted on its Latin America X account.
- • Blockchain investigator TRM Labs said it has "high confidence" the attack was orchestrated by TraderTraitor, a group linked to North Korea and the Lazarus Group, citing on- and off-chain intelligence.
- • Tether said it froze about $1.6bn (€1.4bn) in USDT related to the incident, while Circle said it froze more than $800m (€696m) in USDC.
- • Binance suspended all deposits and withdrawals while it conducts security checks and works with law enforcement; the company attributes the breach to a compromised laptop belonging to a DevOps engineer.
- • Most major cryptocurrencies fell on the news: bitcoin and Ethereum were down 0.8% at about 0400 GMT after earlier plunges of nearly 5% and nearly 6%, while BNB fell nearly 10% before recovering 2.7%.
Summary
Binance, the world's largest crypto exchange by daily trading volume, was hit by a major cyberattack that it says has affected billions of dollars in crypto assets. The company posted a series of sometimes contradictory messages on X, stating that "user funds are completely safe" while also saying it would "cover all losses." Binance later put the total estimated impact at around $6.3bn (€5.5bn), with approximately $3bn (€2.6bn) frozen on-chain so far. That figure would be more than four times the $1.5bn (€1.3bn) taken from the Bybit platform in February 2025, previously the largest cyberattack of its kind. Binance said the figure may continue to rise as it works with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets.
At about 0030 GMT on Friday, Binance suspended all deposits and withdrawals while it conducts security checks, freezes funds and works with law enforcement. Its initial investigation indicated that the intrusion involved a compromised laptop belonging to a DevOps engineer, which allowed an unauthorised party to access a service container and execute unauthorised withdrawal transactions. Binance said it had found no evidence of private key leaks from wallets and promised a detailed technical analysis once investigations are complete. Industry observers said hackers had reached the platform for several hours before Binance confirmed the attack.
Tether CEO Paolo Ardoino said the firm had frozen about $1.6bn (€1.4bn) in USDT "related to a potential Binance exchange hack," and Circle CEO Jeremy Allaire said the company had frozen more than $800m (€696m) in USDC. Both USDT and USDC are dollar-linked stablecoins. The US Department of Justice and the FBI had not immediately responded to requests for comment.
Blockchain investigation firm TRM Labs said on Thursday it had "high confidence" that TraderTraitor, a group believed to be part of the Lazarus Group and linked to North Korea, orchestrated the attack, citing "robust on and off-chain intelligence." TRM said "several features of this attack match earlier North Korea-linked heists." The Bybit heist was attributed to the same group at the time.
Most major cryptocurrencies fell after the news, with stablecoins the exception. At about 0400 GMT, bitcoin and Ethereum were down 0.8%, recovering after plunges of nearly 5% and nearly 6%, respectively. BNB, Binance's native token, rose 2.7% after tumbling nearly 10%. Observers also noted growing concern that advances in artificial intelligence could compromise cryptography and IT security protocols.
At about 0030 GMT on Friday, Binance suspended all deposits and withdrawals while it conducts security checks, freezes funds and works with law enforcement. Its initial investigation indicated that the intrusion involved a compromised laptop belonging to a DevOps engineer, which allowed an unauthorised party to access a service container and execute unauthorised withdrawal transactions. Binance said it had found no evidence of private key leaks from wallets and promised a detailed technical analysis once investigations are complete. Industry observers said hackers had reached the platform for several hours before Binance confirmed the attack.
Tether CEO Paolo Ardoino said the firm had frozen about $1.6bn (€1.4bn) in USDT "related to a potential Binance exchange hack," and Circle CEO Jeremy Allaire said the company had frozen more than $800m (€696m) in USDC. Both USDT and USDC are dollar-linked stablecoins. The US Department of Justice and the FBI had not immediately responded to requests for comment.
Blockchain investigation firm TRM Labs said on Thursday it had "high confidence" that TraderTraitor, a group believed to be part of the Lazarus Group and linked to North Korea, orchestrated the attack, citing "robust on and off-chain intelligence." TRM said "several features of this attack match earlier North Korea-linked heists." The Bybit heist was attributed to the same group at the time.
Most major cryptocurrencies fell after the news, with stablecoins the exception. At about 0400 GMT, bitcoin and Ethereum were down 0.8%, recovering after plunges of nearly 5% and nearly 6%, respectively. BNB, Binance's native token, rose 2.7% after tumbling nearly 10%. Observers also noted growing concern that advances in artificial intelligence could compromise cryptography and IT security protocols.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.