Key Takeaways
- • Binance said a suspected hack affected an estimated $6.3 billion in assets, which would be the largest cryptocurrency theft on record, surpassing the $1.5 billion Bybit theft in February 2025, according to Forbes.
- • Binance attributed the incident preliminarily to a compromised company software engineer's laptop that allowed hackers to initiate unauthorized withdrawals, and said about $3 billion in affected assets had been frozen with blockchain partners.
- • Binance pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and other company funds, found no evidence wallet private keys were leaked, and said it will publish an updated proof of reserves after remediation.
- • Blockchain intelligence firm TRM Labs linked the breach to North Korea's TraderTraitor group with "high confidence," a attribution Pangolin Intelligence also reportedly made.
- • Major cryptocurrencies fell sharply on the news, with Bitcoin dropping about 4.5% to a six-week low of $76,368 before recovering to $78,434.
Summary
Cryptocurrency exchange Binance said Friday that a suspected hack affected an estimated $6.3 billion in assets, potentially the largest cryptocurrency theft on record, according to Forbes. The company suspended withdrawals and pledged to cover customer losses as the value of Bitcoin and other major cryptocurrencies fell. In an official statement, Binance said its preliminary investigation of the "security incident" suggested that a company software engineer's laptop may have been compromised, allowing hackers to access its systems and initiate unauthorized withdrawals. The exchange said it worked with blockchain partners to freeze about $3 billion of the affected assets and found no evidence that any wallet private keys were leaked. Binance is working with law enforcement and blockchain investigators to identify the attackers and recover assets.
Binance said it would cover all losses using its Secure Asset Fund for Users (SAFU) and other company funds, insisting that "User funds are safe." The company will publish an updated proof of reserves once remediation is complete. Changpeng Zhao, Binance co-founder, said in an X post that "It does look like a hack on Binance," adding that as a shareholder he expects all user funds will be fully recovered. Stablecoin issuers also acted: Paolo Ardoino, CEO of Tether, said the company froze more than $1.56 billion "related to a potential Binance exchange hack," and Circle froze more than 800 million USDC, according to Circle chief Jeremy Allaire.
The news triggered a steep sell-off across major cryptocurrencies late Thursday. Bitcoin fell about 4.5% to a six-week low of $76,368 before recovering to $78,434. Ether dropped 5.2% to $2,178 before recovering to $2,236, and BNB fell more than 4.7%. Blockchain intelligence firm TRM Labs published a report linking the breach to North Korea's TraderTraitor hacking group with "high confidence," citing similarities to earlier North Korea-linked heists, including the Bybit attack, and the use of Tornado Cash to obscure fund origins. Pangolin Intelligence also attributed the hack to TraderTraitor, according to The Wall Street Journal. Binance has not commented on the identity of the hackers.
Bloomberg Intelligence analyst James Seyffart described the incident as a meaningful hack on the largest crypto exchange, noting that "It's definitely a bad look. And this is one after another." Binance was last hacked in 2022, when an attacker minted two million BNB tokens worth about $570 million; Binance's intervention reduced the amount taken to roughly $115 million. Separately, prediction market Polymarket halted trading on its international platform after a hack that took about $2.6 million in cryptocurrency from user wallets, according to The Block.
Binance said it would cover all losses using its Secure Asset Fund for Users (SAFU) and other company funds, insisting that "User funds are safe." The company will publish an updated proof of reserves once remediation is complete. Changpeng Zhao, Binance co-founder, said in an X post that "It does look like a hack on Binance," adding that as a shareholder he expects all user funds will be fully recovered. Stablecoin issuers also acted: Paolo Ardoino, CEO of Tether, said the company froze more than $1.56 billion "related to a potential Binance exchange hack," and Circle froze more than 800 million USDC, according to Circle chief Jeremy Allaire.
The news triggered a steep sell-off across major cryptocurrencies late Thursday. Bitcoin fell about 4.5% to a six-week low of $76,368 before recovering to $78,434. Ether dropped 5.2% to $2,178 before recovering to $2,236, and BNB fell more than 4.7%. Blockchain intelligence firm TRM Labs published a report linking the breach to North Korea's TraderTraitor hacking group with "high confidence," citing similarities to earlier North Korea-linked heists, including the Bybit attack, and the use of Tornado Cash to obscure fund origins. Pangolin Intelligence also attributed the hack to TraderTraitor, according to The Wall Street Journal. Binance has not commented on the identity of the hackers.
Bloomberg Intelligence analyst James Seyffart described the incident as a meaningful hack on the largest crypto exchange, noting that "It's definitely a bad look. And this is one after another." Binance was last hacked in 2022, when an attacker minted two million BNB tokens worth about $570 million; Binance's intervention reduced the amount taken to roughly $115 million. Separately, prediction market Polymarket halted trading on its international platform after a hack that took about $2.6 million in cryptocurrency from user wallets, according to The Block.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.