Key Takeaways
- • Binance said a security incident impacted about $6.3 billion in client assets, with roughly $3 billion frozen on-chain, making it the largest crypto hack on record.
- • Binance pledged to cover losses using its Secure Asset Fund for Users (SAFU), created in 2018, and says it has begun recovering affected assets.
- • TRM Labs and Chainalysis point to North Korea-linked actors, with Chainalysis attributing the attack to TraderTraitor based on on-chain activity in the hours after the hack.
- • Binance suspended withdrawals to overhaul its withdrawal security and revoke affected address authorizations, and expects to resume withdrawals within 48 hours; deposits remain unaffected.
- • Circle, Tether and Ripple moved to freeze hack-linked stablecoins, with Circle freezing more than $800 million in USDC and Tether freezing more than $1.5 billion in USDT; Bitcoin fell more than 4% to $77,994.96.
Summary
Binance said on Friday that a security incident affected about $6.3 billion in client assets, with around $3 billion frozen on-chain, according to CNBC. The exchange describes the event as the largest crypto hack on record. Binance later said it had begun recovering affected assets and would cover losses through its Secure Asset Fund for Users, a protection fund the company created in 2018 for client losses from hacks.
The mechanics of the attack remain unclear. Binance first suggested the breach may have involved "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." Co-CEO Richard Teng later said the attack involved a more complex process than misuse of a single engineer's permissions. Binance stated it has found no evidence of a wallet private key leak and will publish a detailed technical post-mortem once the investigation is verified.
Attribution is preliminary. TRM Labs, a blockchain intelligence firm, pointed to North Korean hackers, noting that features of the attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026. Chainalysis said the activity appears to be the work of the North Korean cybercrime group TraderTraitor, based on on-chain activity observed in the hours after the hack. Reuters also reported the attack as blamed on North Korea.
Binance suspended withdrawals while it overhauls its withdrawal security systems and has revoked affected address authorizations, according to co-CEO Teng. The exchange is working with law enforcement and blockchain intelligence firms to trace and recover funds. Co-founder Yi He said deposits were unaffected and the platform continued operating normally, and Binance expects to begin resuming withdrawals within 48 hours.
Circle, Tether and Ripple moved to freeze funds tied to the incident. Circle CEO Jeremy Allaire said the company froze more than $800 million in USD Coin, while Tether CEO Paolo Ardoino said the firm froze more than $1.5 billion in USDT that may be related. Ripple's Jack McDonald said Ripple was actively freezing affected RLUSD holdings. Circle shares fell about 5% in after-hours trading on Thursday.
The hack weighed on broader markets, with Bitcoin falling more than 4% to $77,994.96 on Friday. CNBC noted that exploits are not uncommon in crypto, citing Bybit's roughly $1.5 billion loss in 2025 and Bitget's loss of more than $350 million in a more recent cyber theft.
The mechanics of the attack remain unclear. Binance first suggested the breach may have involved "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." Co-CEO Richard Teng later said the attack involved a more complex process than misuse of a single engineer's permissions. Binance stated it has found no evidence of a wallet private key leak and will publish a detailed technical post-mortem once the investigation is verified.
Attribution is preliminary. TRM Labs, a blockchain intelligence firm, pointed to North Korean hackers, noting that features of the attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026. Chainalysis said the activity appears to be the work of the North Korean cybercrime group TraderTraitor, based on on-chain activity observed in the hours after the hack. Reuters also reported the attack as blamed on North Korea.
Binance suspended withdrawals while it overhauls its withdrawal security systems and has revoked affected address authorizations, according to co-CEO Teng. The exchange is working with law enforcement and blockchain intelligence firms to trace and recover funds. Co-founder Yi He said deposits were unaffected and the platform continued operating normally, and Binance expects to begin resuming withdrawals within 48 hours.
Circle, Tether and Ripple moved to freeze funds tied to the incident. Circle CEO Jeremy Allaire said the company froze more than $800 million in USD Coin, while Tether CEO Paolo Ardoino said the firm froze more than $1.5 billion in USDT that may be related. Ripple's Jack McDonald said Ripple was actively freezing affected RLUSD holdings. Circle shares fell about 5% in after-hours trading on Thursday.
The hack weighed on broader markets, with Bitcoin falling more than 4% to $77,994.96 on Friday. CNBC noted that exploits are not uncommon in crypto, citing Bybit's roughly $1.5 billion loss in 2025 and Bitget's loss of more than $350 million in a more recent cyber theft.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.