Key Takeaways
- • Binance suffered a security incident involving an estimated US$6.3bn in digital assets, which Cyber Magazine describes as the largest crypto theft on record.
- • Initial checks point to a compromised engineer's laptop that gave an attacker access to a service container where unauthorised withdrawals were submitted, according to Binance co-CEO Richard Teng.
- • Approximately US$3bn of the impacted funds has been frozen, and Tether and Circle have together frozen a combined US$2.4bn in assets.
- • TRM Labs and Chainalysis assess with high confidence that North Korea's TraderTraitor unit, linked to Lazarus Group, conducted the attack, which exceeds the US$1.5bn Bybit theft of 2025.
- • Binance says it will cover all losses so customer balances remain safe, and it has suspended deposits and withdrawals while containment proceeds.
Summary
Binance has suffered a security incident resulting in the loss of about US$6.3bn in digital assets, which Cyber Magazine reports is thought to be the largest crypto theft on record. Following the intrusion, the exchange suspended all customer deposits and withdrawals while technical containment took place. Binance confirmed that about US$3bn of the impacted funds has been frozen and said it will cover all losses so that customer balances remain safe. Founder and largest shareholder Changpeng Zhao assured users on X that funds are protected under SAFU (Secure Asset Fund for Users).
Initial checks from Binance indicate the incident may have involved a compromised engineer's laptop. Richard Teng, Co-Chief Executive Officer at Binance, said the device gave an attacker access to a service container where unauthorised withdrawal transactions were submitted. He stated that the attack was not a single one-click action and involved a more complex process, that responsibility has not been attributed to any individual, and that the company has found no evidence of any wallet private key leak. Binance has committed to publishing a detailed technical post-mortem once its investigation concludes.
Raghu Nandakumara, VP of Industry Strategy at Illumio, said the method was familiar despite the scale, noting that the laptop was already authenticated and privileged, which allowed the attacker to reach production systems and then the wallets. Analytics firms TRM Labs and Chainalysis assess with high confidence that TraderTraitor, a North Korean hacking unit connected to Lazarus Group, carried out the attack. The same group was linked to the US$1.5bn theft from the Bybit exchange in 2025. Ari Redbord, Global Head of Policy at TRM Labs, described the event as an "unprecedented watershed" and told Al Jazeera that the proceeds of such thefts fund weapons proliferation, making it a global security issue. Western security agencies have previously said stolen funds finance North Korea's weapons and missile programmes; the regime has denied involvement.
Markets reacted sharply, with Bitcoin falling more than 4% to below US$77,000. Tether and Circle have frozen a combined US$2.4bn in assets, and World Liberty Financial also assisted with freezing funds. Aidan Larkin, Co-Founder and Chief Executive Officer of Asset Reality, said on LinkedIn that the incident is the biggest single heist of all time across any asset category, not just the biggest crypto hack.
Initial checks from Binance indicate the incident may have involved a compromised engineer's laptop. Richard Teng, Co-Chief Executive Officer at Binance, said the device gave an attacker access to a service container where unauthorised withdrawal transactions were submitted. He stated that the attack was not a single one-click action and involved a more complex process, that responsibility has not been attributed to any individual, and that the company has found no evidence of any wallet private key leak. Binance has committed to publishing a detailed technical post-mortem once its investigation concludes.
Raghu Nandakumara, VP of Industry Strategy at Illumio, said the method was familiar despite the scale, noting that the laptop was already authenticated and privileged, which allowed the attacker to reach production systems and then the wallets. Analytics firms TRM Labs and Chainalysis assess with high confidence that TraderTraitor, a North Korean hacking unit connected to Lazarus Group, carried out the attack. The same group was linked to the US$1.5bn theft from the Bybit exchange in 2025. Ari Redbord, Global Head of Policy at TRM Labs, described the event as an "unprecedented watershed" and told Al Jazeera that the proceeds of such thefts fund weapons proliferation, making it a global security issue. Western security agencies have previously said stolen funds finance North Korea's weapons and missile programmes; the regime has denied involvement.
Markets reacted sharply, with Bitcoin falling more than 4% to below US$77,000. Tether and Circle have frozen a combined US$2.4bn in assets, and World Liberty Financial also assisted with freezing funds. Aidan Larkin, Co-Founder and Chief Executive Officer of Asset Reality, said on LinkedIn that the incident is the biggest single heist of all time across any asset category, not just the biggest crypto hack.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.