Key Takeaways
- • Binance reported that digital assets worth approximately $6.3 billion were hacked, which Ratopati describes as the largest cyber theft in the history of financial and digital technology.
- • Binance said it has blocked about half of the potentially affected amount: roughly $3 billion was frozen on-chain with blockchain partners, and Tether and Circle together blocked an additional $2.4 billion.
- • Deputy CEO Richard Teng said customer losses will be fully compensated from the Secure Asset Fund for Users (SAFU) and the company's own resources, and that the withdrawal service has been temporarily suspended.
- • Preliminary investigations trace the breach to a DevOps engineer's laptop, which gave the attacker access to a service container; Teng said there is no evidence that any wallet private key was leaked.
- • TRM Labs and Chainalysis reportedly suspect the North Korean state-sponsored Lazarus Group. No group has claimed responsibility, and Binance has not confirmed a North Korean link.
- • Binance.com was affected, while Binance.US is reported to be secure. Bitcoin fell more than 4% as investors reacted.
Summary
Binance, the world's largest cryptocurrency exchange, has suffered a cyber attack in which digital assets worth approximately $6.3 billion were hacked, according to information provided by Binance and reported by Ratopati. The company says it has managed to block about half of the potentially affected amount, but a large portion of the remainder is still reported to be under the control of the hackers.
Following the public announcement, Deputy CEO Richard Teng reassured users that capital is fully secure and said customer losses will be fully compensated from SAFU and Binance's own sources. Preliminary investigations indicate the attack began with the laptop of a DevOps engineer at the company. The attacker then gained unauthorized access to a service container and carried out transactions to withdraw funds. Teng described the operation as complex and planned rather than a simple or 'one-click' attack, and said the withdrawal service has been temporarily suspended to strengthen security.
No group has officially claimed responsibility. Blockchain analytics firms TRM Labs and Chainalysis reportedly suspect the North Korean state-sponsored Lazarus Group, and analysts cited in the report said the method resembles a prior large exchange hack. Binance has not commented on a direct North Korean connection but says it is working closely with international investigative agencies. Immediately after the attack, about $3 billion was blocked on-chain with blockchain partners, and stablecoin issuers Tether and Circle blocked an additional $2.4 billion. Binance.US, which operates separately for US users, is reported to be unaffected.
Emily Taylor, co-founder of cybersecurity firm Global Signal Exchange, called the attack 'astonishing' in its speed and magnitude and said attackers increasingly use fake job advertisements to deceive skilled engineers and introduce malware into their devices. Bitcoin's price fell by more than 4% as investors panicked. The report notes that Binance manages assets worth over $160 billion for millions of users, and that while the company has pledged compensation, the incident raises questions about the long-term security and reliability of the broader crypto market. Figures in this account come from a single outlet's report and have not been independently confirmed in the source material.
Following the public announcement, Deputy CEO Richard Teng reassured users that capital is fully secure and said customer losses will be fully compensated from SAFU and Binance's own sources. Preliminary investigations indicate the attack began with the laptop of a DevOps engineer at the company. The attacker then gained unauthorized access to a service container and carried out transactions to withdraw funds. Teng described the operation as complex and planned rather than a simple or 'one-click' attack, and said the withdrawal service has been temporarily suspended to strengthen security.
No group has officially claimed responsibility. Blockchain analytics firms TRM Labs and Chainalysis reportedly suspect the North Korean state-sponsored Lazarus Group, and analysts cited in the report said the method resembles a prior large exchange hack. Binance has not commented on a direct North Korean connection but says it is working closely with international investigative agencies. Immediately after the attack, about $3 billion was blocked on-chain with blockchain partners, and stablecoin issuers Tether and Circle blocked an additional $2.4 billion. Binance.US, which operates separately for US users, is reported to be unaffected.
Emily Taylor, co-founder of cybersecurity firm Global Signal Exchange, called the attack 'astonishing' in its speed and magnitude and said attackers increasingly use fake job advertisements to deceive skilled engineers and introduce malware into their devices. Bitcoin's price fell by more than 4% as investors panicked. The report notes that Binance manages assets worth over $160 billion for millions of users, and that while the company has pledged compensation, the incident raises questions about the long-term security and reliability of the broader crypto market. Figures in this account come from a single outlet's report and have not been independently confirmed in the source material.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.