Binance Hit by $6.3 Billion Hack in Biggest Crypto Heist Ever as North Korea Suspected and Withdrawals Frozen
The exchange says it will fully cover customer losses after a suspected internal systems breach, while blockchain firms work to freeze billions in stolen assets.
Binance, the world's largest cryptocurrency exchange, said hackers took an estimated $6.3 billion in digital assets, the biggest theft in the history of the crypto industry. The breach froze withdrawals for millions of customers and sent digital asset prices sharply lower.
"The estimated total impact sits at around $6.3B," Binance said in a post on X. The exchange said it would cover customer losses in full.
"Binance will cover all losses from the SAFU fund and the company's funds," the company said, referring to its Secure Asset Fund for Users, an emergency reserve set up to protect customers.
Blockchain analytics firm Chainalysis estimated the amount stolen at about $5.9 billion at the time of the theft. Either figure is about four times the previous record, the roughly $1.5 billion taken from the Dubai-based exchange Bybit in February 2025.
Engineer's laptop suspected
Binance said its preliminary investigation pointed to a compromised computer belonging to one of its own staff.
"Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop," the company said.
The exchange said the breach may have let attackers reach internal systems and submit unauthorized withdrawals. It said it found no evidence that the private keys controlling its crypto wallets had been leaked. It has not yet determined the root cause.
Binance said it is working with law enforcement and blockchain investigators. The U.S. Justice Department and the FBI did not immediately respond to requests for comment, according to AFP.
North Korea suspected
Several blockchain security firms said the attack bore the hallmarks of North Korean state-backed hackers.
TRM Labs linked the theft with "high confidence" to TraderTraitor, a North Korea-associated hacking group, citing "strong on-chain and off-chain intelligence." Blockchain investigators have previously tied the same group to the Bybit theft.
Independent blockchain investigator ZachXBT named the Lazarus Group, a broader North Korean hacking network, as the likely attacker.
Binance has not publicly identified who was behind the attack.
"This is the biggest crypto hack in history," said Ido Ben-Natan, chief executive of security firm Blockaid.
Billions frozen
Industry players moved quickly to lock down stolen funds.
Binance said about $3 billion in affected assets had been frozen with the help of partners and that the figure could rise. TRM Labs estimated about $2.7 billion had been frozen and said about $2.4 billion remained beyond the reach of companies able to freeze it.
Stablecoin issuers played a key role. Tether Chief Executive Paolo Ardoino said the company froze more than $1.5 billion of its USDT token "related to a potential Binance exchange hack." Circle Chief Executive Jeremy Allaire said his company froze more than $800 million in USDC.
According to CoinDesk, blockchain data showed the attacker's wallets held more than $5.7 billion at one point. The attacker moved funds through the decentralized exchange Uniswap and borrowed at least 20,000 wrapped ether, worth about $44 million, from the lending platform Aave, using stolen USDT as collateral.
Key facts:
- Estimated impact: about $6.3 billion (Binance)
- Chainalysis estimate: about $5.9 billion at time of theft
- Previous record: about $1.5 billion (Bybit, February 2025)
- Frozen so far: about $3 billion, according to Binance
- Suspected attacker: North Korea-linked TraderTraitor, according to TRM Labs
- Customer losses: Binance pledges to cover them in full
Withdrawals paused
Binance suspended deposits and withdrawals early Friday while it carried out security checks. It later restored deposits but kept withdrawals on hold.
"Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses," Binance said. "We expect to resume within 48 hours, and will update with further details."
Co-Chief Executive Yi He said the exchange was "working on improving the withdrawal service and related address controls."
The company repeatedly told customers that "user funds are safe" and said it would publish an updated proof of reserves after completing its remediation work.
Founder weighs in
Binance founder Changpeng Zhao, who stepped down as chief executive in 2023 but remains a major shareholder, confirmed the breach on social media.
"It does look like a hack on Binance," Zhao wrote on X. He said he no longer manages the exchange, but that as a shareholder he expects customers' funds to be made whole.
Binance held about $144 billion in assets before the hack, CoinDesk reported, which would put the stolen funds at roughly 4% of its holdings. Its SAFU fund holds about $1 billion in bitcoin.
Crypto prices slide
News of the hack rattled crypto markets.
Bitcoin fell nearly 5% to below $77,000, and ether dropped nearly 6%. Binance's own BNB token was hit hardest, falling as much as 10% at one point, AFP reported. Aave's token fell 11%.
Industry under pressure
The attack is the latest in a string of high-profile security failures for the crypto industry.
"It's definitely a bad look. And this is one after another," said James Seyffart, an analyst at Bloomberg Intelligence.
Exchange BitGet lost about $388 million in a hack in September. Prediction market Polymarket also reported a breach on the same day as the Binance attack, halting trading on its international platform. The Block reported about $2.6 million was taken from Polymarket users' wallets.
Binance itself was hit in 2022, when an attacker exploited a bridge linked to its BNB blockchain to mint tokens worth about $570 million. The company's intervention limited the losses to about $115 million.
What comes next
The size of the theft is likely to put fresh pressure on regulators and exchanges to tighten security around internal systems, particularly the "hot wallets" exchanges keep connected to the internet to process customer withdrawals.
Investors will be watching whether Binance resumes withdrawals within its promised 48-hour window, how much of the frozen money can be recovered and whether authorities formally attribute the attack.
If North Korea is confirmed as responsible, it would extend a campaign of crypto theft that U.S. and United Nations officials say has helped fund the country's weapons programs.
This article is for information only and does not constitute financial advice.
© Copyright 2026 IBTimes AU. All rights reserved.