Hackers steal up to $6.3 billion from Binance in the largest crypto breach on record

Binance, the world’s largest cryptocurrency exchange by trading volume, confirmed a major security breach early Friday after hackers drained an estimated $5.9 to $6.3 billion from its hot wallets — what Chainalysis is calling the largest cryptocurrency theft ever recorded.

The attack appears to have begun Thursday evening when on-chain monitoring tools flagged unusual outflows across BNB Chain, Ethereum, and TRON. Binance suspended withdrawals across multiple networks as a precaution within hours of identifying the incident. Co-CEO Yi He confirmed in a public statement that the exchange will cover all user losses.

According to Binance’s initial forensic investigation, the attackers gained access through a compromised laptop belonging to a DevOps engineer. That foothold allowed them to reach a service container used to process withdrawals, from which they submitted fraudulent transfer requests. The company says it found no evidence that wallet private keys were exposed, which limits the theoretical maximum of future losses from the same vector.

The attackers moved quickly to exploit their access. They borrowed approximately 20,000 WETH (around $44 million) from lending protocol Aave using stolen USDT as collateral and funneled portions of the haul through Uniswap. Bitcoin worth $1.45 billion and approximately $875 million in ETH were among the assets moved.

Two blockchain intelligence firms attributed the attack to North Korean state actors. TRM Labs linked it to a group it tracks as “TraderTraitor,” while ZachXBT named the Lazarus Group. Both are the same North Korean operation believed responsible for the $1.4 billion Bybit theft in February 2025. If the attribution holds, the attack fits North Korea’s documented pattern of funding its weapons program through large-scale crypto heists.

Stablecoin issuers moved quickly to contain the damage. Tether froze approximately $1.57 billion in USDT tied to the hack, and Circle froze over $800 million in USDC. In total, roughly $2.54 billion of the stolen funds has been frozen, though a substantial portion remains unrecovered.

The broader crypto market felt the shock: Bitcoin fell 4.8% to below $77,000, Ether dropped 5.7%, BNB fell 8%, and AAVE tumbled 11%. In a separate incident, prediction market Polymarket disclosed its own third-party breach with estimated losses under $3 million.

Binance says its Secure Asset Fund for Users (SAFU) — currently holding roughly $1 billion in Bitcoin — combined with company funds will cover the full impact. Whether that commitment survives the complete accounting remains to be confirmed. The exchange says it is cooperating with law enforcement and will publish a full post-mortem once its investigation concludes.

As first reported by TechCrunch’s Zack Whittaker and CoinDesk, with chain analysis from Chainalysis, TRM Labs, and ZachXBT.