Key Takeaways
- • Binance said late Thursday that $6.3 billion in user funds had been affected by an attacker, in what appears to be the largest theft of digital currencies in history, according to The Washington Post.
- • Around $3 billion had been frozen by various partners as of the report, with Tether reporting more than $1.57 billion frozen and Circle about $800 million; World Liberty Financial said it froze $27 million.
- • Initial Binance investigation suggested an attacker compromised an engineer's laptop, enabling unauthorized withdrawals; Binance suspended deposits and withdrawals.
- • Binance said it would cover user losses from existing funds and a $1 billion bitcoin rainy-day fund.
- • TRM Labs and Pangolin Intelligence attributed the incident to the North Korean-backed group TraderTraitor, which Binance has not publicly confirmed as responsible.
Summary
Binance, the world's largest cryptocurrency exchange, said late Thursday that $6.3 billion in user funds had been affected by an attacker in what appears to be by far the largest theft of digital currencies in history, according to The Washington Post. The company said around $3 billion had been frozen by various partners so far. Binance said on social media that its initial investigation suggested an attacker had compromised an engineer's laptop, enabling unauthorized withdrawals. The company suspended deposits and withdrawals and said it would cover users' losses by drawing from its existing funds and a $1 billion bitcoin rainy-day fund.
The incident triggered a rapid response across the crypto industry as companies moved to secure their assets. Executives at stablecoin issuers Tether and Circle said they had frozen more than $1.57 billion and $800 million, respectively. World Liberty Financial, a crypto firm whose co-founders include members of the Trump family, said it had frozen $27 million in relation to the apparent hack. TRM Labs' global head of policy, Ari Redbord, said freezes by Tether, Circle and others had halted about 40% of the stolen funds within hours, calling the response "the largest in history" alongside the hack itself.
Binance has not said who it believes is responsible. However, TRM Labs and Pangolin Intelligence, two cybersecurity threat analysis firms, attributed the incident late Thursday to the North Korean-backed hacker group TraderTraitor. Redbord said the funds go toward weapons proliferation and other destabilizing activity, framing the case as a national security issue. The FBI has previously blamed TraderTraitor for a $1.5 billion theft from exchange Bybit in 2025, and the group earlier stole $600 million from a cryptocurrency-based video game.
Company founder and former CEO Changpeng Zhao said on social media Thursday that "it does look like a hack on Binance." Zhao stepped down as CEO in 2023 after pleading guilty in the United States to violating criminal anti-money-laundering guidelines; he was later pardoned by President Donald Trump and remains the company's largest shareholder. Binance said it is working with law enforcement partners to identify the perpetrators. Binance says its average daily trading volume is about $95 billion, and its U.S. affiliate, Binance.US, said it was not affected.
The incident triggered a rapid response across the crypto industry as companies moved to secure their assets. Executives at stablecoin issuers Tether and Circle said they had frozen more than $1.57 billion and $800 million, respectively. World Liberty Financial, a crypto firm whose co-founders include members of the Trump family, said it had frozen $27 million in relation to the apparent hack. TRM Labs' global head of policy, Ari Redbord, said freezes by Tether, Circle and others had halted about 40% of the stolen funds within hours, calling the response "the largest in history" alongside the hack itself.
Binance has not said who it believes is responsible. However, TRM Labs and Pangolin Intelligence, two cybersecurity threat analysis firms, attributed the incident late Thursday to the North Korean-backed hacker group TraderTraitor. Redbord said the funds go toward weapons proliferation and other destabilizing activity, framing the case as a national security issue. The FBI has previously blamed TraderTraitor for a $1.5 billion theft from exchange Bybit in 2025, and the group earlier stole $600 million from a cryptocurrency-based video game.
Company founder and former CEO Changpeng Zhao said on social media Thursday that "it does look like a hack on Binance." Zhao stepped down as CEO in 2023 after pleading guilty in the United States to violating criminal anti-money-laundering guidelines; he was later pardoned by President Donald Trump and remains the company's largest shareholder. Binance said it is working with law enforcement partners to identify the perpetrators. Binance says its average daily trading volume is about $95 billion, and its U.S. affiliate, Binance.US, said it was not affected.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.