Key Takeaways
- • Hackers drained about $6.3 billion in cryptocurrency from wallets Binance uses to process transactions in a record digital asset theft, with most of the outflows occurring in roughly 20 minutes beginning shortly after 8pm on the day of the attack, according to blockchain records.
- • Binance initially attributed the attack to a compromised laptop but said its subsequent investigation uncovered additional points of breach; TRM Labs said attackers compromised the exchange's signing infrastructure, which authorises transactions.
- • About half of the stolen assets, mainly stablecoins, have been frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, while TRM estimates roughly $2.4 billion in bitcoin and ether is beyond reach.
- • Several US blockchain analysts link the breach to North Korean hackers, citing similarities to the 2025 Bybit attack that the FBI attributed to North Korea; North Korea routinely denies involvement and Binance has not yet identified the attackers.
- • Binance says losses will be covered by its Secure Asset Fund for Users (SAFU), a roughly $1 billion bitcoin reserve, and company resources, while insurance coverage for crypto theft remains limited and subject to policy exclusions.
Summary
Hackers stole approximately $6.3 billion from Binance, the world's largest cryptocurrency exchange, in what is described as a record digital asset theft. According to the exchange and blockchain analysis, the funds were drained from wallets Binance uses to process transactions. Binance said in a statement on X that it initially believed the attack involved a compromised laptop, but that its subsequent investigation had uncovered additional points of breach. US blockchain analytics firm TRM Labs said the attackers compromised Binance's signing infrastructure, which authorises transactions, allowing them to issue instructions that emptied the affected wallets. Blockchain records show the bulk of the heist unfolded in about 20 minutes.
Attribution remains unconfirmed. Several US blockchain analysis firms said the attack bears similarities to earlier operations attributed to North Korean hackers. TRM said the breach shared characteristics with last year's attack on Bybit, which the FBI attributed to North Korea, and said it was highly confident the same group was responsible. Chainalysis reported that funds stolen in an attack last month on Bitget were being mixed with proceeds from the Binance breach. Co-CEO Richard Teng said the investigation had not yet identified the attackers. North Korea's mission in Geneva and its embassy in China did not immediately respond to requests for comment.
About half of the stolen assets were stablecoins that have since been frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, the Trump family's crypto venture. TRM said some funds had already been posted as collateral to borrow ether and estimated that about $2.4 billion in bitcoin and ether is beyond reach, since no central entity can freeze those assets. Analysts expect the attackers to try to mix the coins or use lesser-known exchanges. Chainalysis said it was observing laundering patterns it had not seen before, including thousands of transactions in a short period that suggest automation. Attackers stole $2.9 billion across nearly 150 incidents last year, according to TRM Labs. Cryptocurrencies fell on Friday and the total market value of stablecoins declined.
On loss coverage, Binance said Teng stated losses would be covered by the Secure Asset Fund for Users (SAFU), established in July 2018 and holding roughly $1 billion in bitcoin as of 2026 according to the company's website, along with company resources. Insurance for crypto assets remains a niche market served mainly by specialist insurers in the Lloyd's market and Bermuda, with coverage depending on storage methods, attack vectors and policy terms. Common exclusions include value fluctuations, fraudulent acts by the policyholder and unsecured or negligent key management. Jacqueline Quintal, Marsh's financial institutions and digital asset industry leader, told Reuters that firms need to understand exclusions and sublimits, and that security controls and financial strength are equally important to resilience.
Attribution remains unconfirmed. Several US blockchain analysis firms said the attack bears similarities to earlier operations attributed to North Korean hackers. TRM said the breach shared characteristics with last year's attack on Bybit, which the FBI attributed to North Korea, and said it was highly confident the same group was responsible. Chainalysis reported that funds stolen in an attack last month on Bitget were being mixed with proceeds from the Binance breach. Co-CEO Richard Teng said the investigation had not yet identified the attackers. North Korea's mission in Geneva and its embassy in China did not immediately respond to requests for comment.
About half of the stolen assets were stablecoins that have since been frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, the Trump family's crypto venture. TRM said some funds had already been posted as collateral to borrow ether and estimated that about $2.4 billion in bitcoin and ether is beyond reach, since no central entity can freeze those assets. Analysts expect the attackers to try to mix the coins or use lesser-known exchanges. Chainalysis said it was observing laundering patterns it had not seen before, including thousands of transactions in a short period that suggest automation. Attackers stole $2.9 billion across nearly 150 incidents last year, according to TRM Labs. Cryptocurrencies fell on Friday and the total market value of stablecoins declined.
On loss coverage, Binance said Teng stated losses would be covered by the Secure Asset Fund for Users (SAFU), established in July 2018 and holding roughly $1 billion in bitcoin as of 2026 according to the company's website, along with company resources. Insurance for crypto assets remains a niche market served mainly by specialist insurers in the Lloyd's market and Bermuda, with coverage depending on storage methods, attack vectors and policy terms. Common exclusions include value fluctuations, fraudulent acts by the policyholder and unsecured or negligent key management. Jacqueline Quintal, Marsh's financial institutions and digital asset industry leader, told Reuters that firms need to understand exclusions and sublimits, and that security controls and financial strength are equally important to resilience.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.