Key Takeaways
- • Binance said late Thursday that $6.3 billion in user funds had been affected by an attacker, making it by far the largest theft of digital currencies in history, according to The Washington Post.
- • Approximately $3 billion had been frozen by various partners as of the initial disclosure, with Tether reporting more than $1.57 billion frozen and Circle about $800 million.
- • TRM Labs and Pangolin Intelligence attributed the incident to the North Korean-backed group TraderTraitor, though Binance had not named a perpetrator.
- • Binance suspended deposits and withdrawals and said it would cover user losses from existing funds and a $1 billion bitcoin reserve fund.
- • Initial Binance claims of a compromised engineer's laptop were expanded to 'additional points of breach' as the investigation continued.
Summary
Binance, the world's largest cryptocurrency exchange, said late Thursday that $6.3 billion in user funds had been affected by an attacker in what appears to be by far the largest theft of digital currencies in history, according to The Washington Post. The company said roughly $3 billion had been frozen by various partners so far. Binance initially attributed the breach to a compromised engineer's laptop that enabled unauthorized withdrawals, but said early Friday that the hack was more complex and involved "additional points of breach."
The incident triggered a wave of activity across the crypto industry as firms moved to secure assets. Tether said it had frozen more than $1.57 billion and Circle said it had frozen about $800 million. Both are stablecoins pegged to a stable asset such as the U.S. dollar, unlike volatile bitcoin. World Liberty Financial, a crypto firm whose co-founders include members of the Trump family, said it had frozen $27 million related to the apparent hack.
Binance has not said who it believes is responsible. However, TRM Labs and Pangolin Intelligence, two cybersecurity threat analysis firms, attributed the incident late Thursday to the North Korean-backed group TraderTraitor. Ari Redbord, TRM's global head of policy, said the funds support weapons proliferation and destabilizing activity, framing it as a national security issue. He also noted that stablecoin issuers and others froze about 40% of the stolen funds within hours. Chainalysis researchers observed stolen Binance funds mixing with proceeds from another crypto breach earlier in the month that was also attributed to North Korean hackers, and said the attackers rushed to move funds into non-freezable cryptocurrencies such as bitcoin.
Binance said it had suspended deposits and withdrawals and would cover users' losses using existing funds and a $1 billion bitcoin rainy-day fund. The company said it was working with law enforcement to identify the perpetrators. Founder and former CEO Changpeng Zhao said on social media that it "does look like a hack on Binance." Zhao stepped down as CEO in 2023 after pleading guilty in the United States to violating anti-money-laundering guidelines, was later pardoned by President Donald Trump, and remains the company's largest shareholder.
TraderTraitor has been blamed for prior record crypto thefts, including a $1.5 billion theft from Bybit in 2025 according to the FBI, and a $600 million theft from a cryptocurrency-based video game. Binance says its average daily trading volume is about $95 billion, making it the largest crypto trading platform globally. Its U.S. affiliate, Binance.US, said it was not affected.
The incident triggered a wave of activity across the crypto industry as firms moved to secure assets. Tether said it had frozen more than $1.57 billion and Circle said it had frozen about $800 million. Both are stablecoins pegged to a stable asset such as the U.S. dollar, unlike volatile bitcoin. World Liberty Financial, a crypto firm whose co-founders include members of the Trump family, said it had frozen $27 million related to the apparent hack.
Binance has not said who it believes is responsible. However, TRM Labs and Pangolin Intelligence, two cybersecurity threat analysis firms, attributed the incident late Thursday to the North Korean-backed group TraderTraitor. Ari Redbord, TRM's global head of policy, said the funds support weapons proliferation and destabilizing activity, framing it as a national security issue. He also noted that stablecoin issuers and others froze about 40% of the stolen funds within hours. Chainalysis researchers observed stolen Binance funds mixing with proceeds from another crypto breach earlier in the month that was also attributed to North Korean hackers, and said the attackers rushed to move funds into non-freezable cryptocurrencies such as bitcoin.
Binance said it had suspended deposits and withdrawals and would cover users' losses using existing funds and a $1 billion bitcoin rainy-day fund. The company said it was working with law enforcement to identify the perpetrators. Founder and former CEO Changpeng Zhao said on social media that it "does look like a hack on Binance." Zhao stepped down as CEO in 2023 after pleading guilty in the United States to violating anti-money-laundering guidelines, was later pardoned by President Donald Trump, and remains the company's largest shareholder.
TraderTraitor has been blamed for prior record crypto thefts, including a $1.5 billion theft from Bybit in 2025 according to the FBI, and a $600 million theft from a cryptocurrency-based video game. Binance says its average daily trading volume is about $95 billion, making it the largest crypto trading platform globally. Its U.S. affiliate, Binance.US, said it was not affected.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.