Binance, the world’s largest cryptocurrency exchange, confirmed a security incident this week that resulted in the loss of roughly $6.3 billion in digital assets, according to the company’s own disclosure. The figure makes it the largest cryptocurrency theft ever recorded, surpassing the approximately $1.5 billion stolen from the Bybit exchange in February 2025.
Blockchain analytics firms arrived at similar but not identical figures. Chainalysis put the amount taken at close to $5.9 billion at the moment of the theft, nearly four times the size of the previous record. Elliptic estimated the total closer to $6.43 billion. The gap between these numbers reflects how quickly the value of stolen tokens shifts once they hit the open market, and how differently each firm defines which transactions belong to the incident.
How the theft happened
Binance’s early investigation points to a compromised laptop belonging to a member of its DevOps team as the starting point. According to the company, the attacker used that initial foothold to reach a service container and from there submit unauthorized withdrawal requests. Binance co-CEO Richard Teng said the operation was not as simple as one engineer’s stolen permissions, describing it instead as a more complex, multi-stage process. Binance later said its investigation had turned up “additional points of breach” beyond the original compromised laptop, suggesting the full picture is still being pieced together.
Blockchain intelligence firm TRM Labs said the attacker never obtained Binance’s private keys. Instead, they appear to have tricked Binance’s own signing infrastructure into authorizing transactions on their behalf. The attacker is believed to have taken control of a Binance hot wallet more than 36 hours before the theft, funded a separate operator wallet through a series of small withdrawals routed through the Tornado Cash mixing service, and tested the attack code on three wallets a few hours before striking. At 20:20 UTC, the attacker submitted a single transaction carrying 50 pre-signed authorizations, each tied to a sweeper contract built to accept instructions only from the attacker’s own operator address. Because the hot wallet was processing a steady stream of legitimate withdrawals at the time, one of those 50 signatures eventually lined up with the wallet’s transaction sequence number. About three and a half minutes later, the operator ordered the hot wallet to send its entire balance to an address under the attacker’s control.
Freezing the funds
Binance said it would cover customer losses using its Secure Asset Fund for Users and its own capital, and it temporarily suspended deposits and withdrawals while it reviewed the affected systems. Several other organizations moved quickly to freeze stolen funds once they were identified on-chain. Tether froze more than 1.567 billion USDT, and Circle froze 800 million USDC. The Arbitrum Security Council froze roughly $30.5 million in ETH and ARB tokens. Taken together with contributions from Ripple and World Liberty Financial, stablecoin issuers and related parties had frozen roughly $2.67 billion at one point, and Elliptic separately put the total frozen figure at about $2.84 billion.
Even so, a significant share of the stolen funds remains outside anyone’s reach. Elliptic estimated that about $3.33 billion is still under the attacker’s control, spread across roughly 43 wallets and including more than 511,000 ETH, over 18,000 BTC, and large holdings of XRP and TRX. Stablecoins can be frozen by their issuers because those tokens run on centralized ledgers the issuers control, but bitcoin and ether have no equivalent mechanism, which is part of why so much of the haul is effectively unrecoverable without law enforcement intervention.
Links to North Korea
TRM Labs said it attributes the attack with high confidence to TraderTraitor, a hacking group tied to North Korea and the same group blamed for the Bybit theft last year. Chainalysis reached a similarly confident conclusion, pointing to an Ethereum address that received funds from both the Binance theft and an earlier exploit of the Bitget exchange, a sign the same operators may have handled both sets of stolen funds. Chainalysis also flagged unusually fast, repeated movement of funds between wallets as a laundering pattern it had not seen in quite this form before.
Elliptic was more cautious. While it agreed the attack shares similarities with past North Korean operations, it noted differences in how quickly funds were laundered this time and pointed out that Binance has not yet published a confirmed root cause, something it said should temper firm conclusions about attribution.
What happens next
Binance said it expected to restore withdrawals within roughly 48 hours of its most recent update, after completing what it described as a security overhaul of its withdrawal service. The company said it is working with law enforcement and outside blockchain forensics firms to map the full attack sequence, and that it takes full responsibility for resolving the incident. As of publication, Binance had not released a detailed root-cause report, and the final confirmed totals for funds stolen, frozen and still at large may still change as the investigation continues.
Source: This article is based on reporting from The Hacker News.
