Binance hacked for an estimated $6.3 billion in record crypto theft

Approximately $3 billion has been frozen on-chain by Binance's blockchain partners following a massive digital theft, as the cryptocurrency exchange faces what is being described as a record-breaking cyberattack.

According to reporting from The New York Times, the exchange has suffered a cyber intrusion estimated to be worth $6.3 billion. While the platform has placed a hold on withdrawals, it has assured its users that it intends to cover every loss. This potential theft amount would easily surpass the $1.5 billion loss experienced by the Bybit exchange in the preceding year, making it a monumental event if the figures prove accurate.

The company communicated via a post on its own website that "The estimated total impact is around $6.3 billion, and [Binance] has worked with blockchain partners to freeze affected assets, with approximately $3 billion frozen on-chain so far." Furthermore, Binance affirmed that "user funds are safe" because the company and its SAFU [Secure Asset Fund for Users] fund will cover all incurred losses. Separately, Binance issued another statement explaining that the withdrawal freeze was implemented "for [a] security revamp," while confirming that deposits were proceeding as normal.

Other crypto entities have also taken action: Tether and Circle have each frozen funds amounting to $1.5 billion and $800 million, respectively, that are linked to the incident. CZ, the CEO, commented on the situation, stating, "I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered," while also appreciating the swift freezing actions by Tether (roughly $971m) and Circle (roughly $823m).

The initial investigation conducted by Binance suggests that the breach may have originated from a compromised laptop belonging to a DevOps engineer, which potentially allowed an attacker to gain entry to a service container and subsequently execute unauthorized withdrawal transactions.

Security research firm TRM labs has pointed toward North Korea as the perpetrator, attributing the attack to TraderTraitor, which is identified as North Korea's highly specialized hacking unit. This attribution is based on "robust on- and off-chain intelligence," and TRM labs stated it makes this judgment with "high confidence," while actively monitoring the funds and notifying partners through its Beacon Network, a system designed to track cryptocurrency crimes in real time.

The sheer scale of this breach has sent shockwaves throughout the digital asset community. Tim Sun, a senior researcher at HashKey Group, informed Reuters that this event "may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralized exchanges, as well as counterparty, solvency and liquidity risks."

It is worth noting that Binance founder Changpeng Zhao previously pleaded guilty in 2023 to a felony related to his failure to prevent money laundering, though he subsequently received a pardon from Donald Trump in 2025. Moreover, the company maintains a business association with the Trump family's crypto venture, World Liberty Financial.