Key Takeaways
- • Binance suspended customer withdrawals after an estimated $6.3bn cyberattack, potentially the largest cryptocurrency theft on record, according to the Financial Times.
- • Binance has frozen approximately $3bn in affected assets and is working with law enforcement, and says it will cover customer losses from reserve funds and company capital.
- • Blockchain intelligence firm TRM Labs linked the attack to TraderTraitor, a North Korean hacking group, though responsibility has not been independently established.
- • Tether and Circle have frozen approximately $1.5bn and $800m respectively in tokens linked to the suspected breach.
- • Binance said no customer private keys were found to be breached and expects to restore withdrawals within 48 hours, while the investigation continues.
Summary
Binance, the world's largest cryptocurrency exchange, has suspended customer withdrawals after suffering an estimated $6.3bn cyberattack, potentially the largest cryptocurrency theft on record, according to a report by the Financial Times. The scale of the breach significantly exceeds the $1.5bn stolen from rival exchange Bybit in 2025, underscoring the growing threat posed by sophisticated cybercriminal operations targeting digital asset platforms.
According to the exchange, an initial investigation identified a compromised engineer's laptop as a potential entry point, although further security breaches have since been uncovered. Binance has frozen approximately $3bn in affected assets and is working with law enforcement to investigate the incident. Binance, which holds approximately $140bn in digital assets, said it would cover customer losses using reserve funds and company capital. Stablecoin issuers Tether and Circle have also frozen approximately $1.5bn and $800m respectively in tokens linked to the suspected breach.
Blockchain intelligence firm TRM Labs linked the attack to TraderTraitor, a North Korean hacking group, although responsibility has not been independently established. Binance said it had found no evidence that customer private keys were breached and expects to restore withdrawals within 48 hours, although the investigation remains ongoing.
The incident coincided with a broader downturn in the cryptocurrency market. Bitcoin fell approximately 4% following news of the attack before recovering to trade above $78,000. The market has been under pressure since a selloff late last year that erased more than $1tn from the sector's combined market capitalisation.
The attack has renewed scrutiny of custody arrangements across the digital asset industry, particularly among hedge funds and institutional investors seeking to limit exchange-related counterparty exposure. Some institutions have increasingly adopted third-party custody structures to reduce the risk of assets being compromised through trading platforms.
According to the exchange, an initial investigation identified a compromised engineer's laptop as a potential entry point, although further security breaches have since been uncovered. Binance has frozen approximately $3bn in affected assets and is working with law enforcement to investigate the incident. Binance, which holds approximately $140bn in digital assets, said it would cover customer losses using reserve funds and company capital. Stablecoin issuers Tether and Circle have also frozen approximately $1.5bn and $800m respectively in tokens linked to the suspected breach.
Blockchain intelligence firm TRM Labs linked the attack to TraderTraitor, a North Korean hacking group, although responsibility has not been independently established. Binance said it had found no evidence that customer private keys were breached and expects to restore withdrawals within 48 hours, although the investigation remains ongoing.
The incident coincided with a broader downturn in the cryptocurrency market. Bitcoin fell approximately 4% following news of the attack before recovering to trade above $78,000. The market has been under pressure since a selloff late last year that erased more than $1tn from the sector's combined market capitalisation.
The attack has renewed scrutiny of custody arrangements across the digital asset industry, particularly among hedge funds and institutional investors seeking to limit exchange-related counterparty exposure. Some institutions have increasingly adopted third-party custody structures to reduce the risk of assets being compromised through trading platforms.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.