Binance loses about $6.3 billion in the biggest crypto theft on record

According to blockchain firm TRM Labs, an attacker moved about $6.36 billion out of Binance wallets across ten blockchains. Most of it went in about 20 minutes, starting at 20:05 UTC on Thursday.

Binance confirmed the breach and suspended all deposits and withdrawals. TechCrunch first reported on Thursday that the exchange had paused withdrawals on some blockchains.

Binance posted on X that its early investigation points to a compromised engineer's laptop. That access let an attacker reach a service container and submit unauthorized withdrawal transactions.

A service container is a small, isolated program environment that runs part of a company's systems. Think of it as a locked room inside a bigger building, one that can send payment orders.

Binance Co-CEO Richard Teng said the attacker did not simply use one engineer's permissions. "This was not a single 'one-click' action," he said, per BleepingComputer. By Friday morning, Binance said it had "uncovered additional points of breach."

The catch: it is still unclear how the laptop was compromised. TechCrunch notes that hacks often start with tainted software on an employee's device.

Binance has not named a group. Several outside firms have.

• TRM Labs: blames TraderTraitor, a North Korean state-backed hacking unit also tracked as Lazarus Group and APT38.
• Chainalysis: says it is confident "with a high degree of confidence" that TraderTraitor is responsible, per BleepingComputer.
• Elliptic: also points to North Korean hackers, and says some funds landed in a wallet used in an earlier attack on the exchange Bitget.

TechCrunch says the same group was blamed for the $1.4 billion Bybit theft in 2025. TRM puts that heist at $1.5 billion, which is why it calls this one about four times bigger.

Binance says user funds are safe. Teng told customers: "Your money is safe, and we're covering every loss," per Ars Technica.

TechCrunch notes Binance has not yet provided proof for that claim. The company says it will publish an updated proof of reserves, a report meant to show it holds enough assets to match what customers are owed, once the clean-up is done.

In real life If you keep coins on Binance, you cannot move them out until withdrawals reopen. Co-CEO Yi He said on X that the exchange expected that "in the next 48 hours."

Binance says it will cover all losses from its SAFU fund, an emergency reserve, and from company funds. It said it had already reserved over $6.34 billion of company money, with $5 billion already held in the exact tokens affected, per Ars Technica.

The reserve fund held about $1 billion in bitcoin in mid-October, Ars reports. Co-founder Changpeng Zhao wrote that this leaves about $2 billion to cover, and called the gap "painful, but manageable."

Yi He said annual revenue is enough to cover the losses. Zhao has said that revenue is about $5 billion a year.

Stolen crypto can sometimes be frozen by the companies that issue it. Stablecoins, which are digital tokens pegged to the dollar, are the easiest to freeze.

TRM says Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion. Together with a freeze by Arbitrum's Security Council, the total is roughly $2.7 billion. Binance's spokesperson put the frozen amount at about $3 billion.

Not everything can be stopped. TRM says the attacker raced the freezes by selling stablecoins and borrowing against them. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion out of reach. Elliptic puts the unfreezable amount at about $3.3 billion.

The earlier record was the Bybit hack of February 2025. Binance is also the largest exchange. Ars Technica says it holds about $140 billion in digital assets.

Ars adds some context for the company:

• 2023: Binance pleaded guilty to US criminal charges about anti-money laundering controls and paid a $4.3 billion fine.
• July 2026: it was ordered to wind down its EU operations after failing to secure a licence under the bloc's new rules.
• December 2025: it became regulated in Abu Dhabi, whose regulator says it is "engaging closely with Binance."

Why it matters: crypto exchanges hold huge piles of customer assets, and that makes them targets. Ars notes North Korean hackers stole about $2 billion in crypto in 2025, per Chainalysis.

TechCrunch describes TraderTraitor as a North Korean cell focused almost entirely on stealing crypto from large companies and exchanges. It says researchers see crypto theft as a way to fund the country's sanctioned weapons programs.

Peter Ward of the Sejong Institute in Seoul told the Financial Times, as quoted by Ars Technica, that North Korea has considerable expertise and gives its hackers "near-total protection." "Things may get a lot worse going forward," he said.

By the numbers: Chainalysis data cited by Ars shows North Korean hackers stole about $2 billion in crypto in 2025, up 50% from the year before. One Binance attack is now more than three times that.

Not as badly as you might fear. Ars Technica reports bitcoin fell about 4% in the hours after the hack emerged late Thursday, then regained ground to trade above $78,000.

The wider market was already weak. Ars says crypto has been in a long downturn since a sharp sell-off late last year, which wiped more than $1 trillion from the combined value of about 18,000 tokens.

Tether's chief executive, Paolo Ardoino, said his company had frozen about $1.5 billion of USDT, its dollar-linked stablecoin. Ars notes that coin is worth about $180 billion in total.

No. Ars lists a string of recent heists. Nearly $390 million was stolen from the exchange Bitget last month, and Bitget paid customers back from its User Protection Fund. In April, about $280 million was stolen from the unregulated exchange Drift.

The pattern is the same each time. Exchanges hold customer assets in one place, so one breach can reach a lot of money.

TechCrunch says the incident is not confirmed to be resolved and the stolen amount may change. Early outlets reported lower figures, such as $5.6 billion.

Binance will also face questions about why one employee's laptop could reach systems able to move billions. TechCrunch asked whether anyone audited the network before the hack. Binance did not respond.

What's next: the reopening of withdrawals, the updated proof of reserves, and what law enforcement finds.

• If you hold crypto on Binance, expect withdrawals to stay paused for now, and watch Binance's official posts for the reopening and the proof of reserves.
• If you hold crypto on any exchange, consider what you actually need left there. Ars notes some investors use third-party custody to keep funds elsewhere.
• If you work in IT, note that one compromised laptop was enough to start this. Limiting what a single device can reach matters.
• Watch for scams. Big hacks bring fake "recovery" messages. Use only official Binance channels.