Hackers Drain $6.3 Billion From Binance in Largest Crypto Theft on Record

Hackers drained about $6.3 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange, in what appears to be the biggest crypto theft ever recorded, according to the exchange and blockchain analysts.

Binance said Friday it had begun recovering affected assets and was working with law enforcement and blockchain intelligence firms to trace more of the stolen funds. The exchange suspended deposits and withdrawals while security checks run, and said it expects withdrawal services to resume by Sunday morning.

How the theft unfolded

The bulk of the theft unfolded in about 20 minutes, beginning shortly after 2000 GMT on Thursday, according to blockchain records reviewed by Reuters. The funds came from wallets Binance uses to process transactions.

Binance said its initial investigation pointed to a compromised laptop belonging to an engineer, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. The company later said its investigation had uncovered additional points of breach, without giving details. TRM Labs, a blockchain analytics firm, said the attackers compromised Binance’s signing infrastructure, which authorizes transactions, and used it to issue instructions that emptied the affected wallets.

TRM Labs attributed the heist to TraderTraitor, a North Korean hacking unit, based on on-chain and off-chain evidence, and said it had high confidence in the finding. Chainalysis said it also had high confidence North Korea was behind the attack, and Pangolin Intelligence, a Singapore-based tracking firm, reached the same view. Binance’s own investigation has not identified the attackers, and co-CEO Richard Teng said on X that the attack was not a “one-click” action. North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts, and CNN said it had reached out to North Korea’s mission at the UN for comment.

Half the funds frozen, billions still out of reach

About $3 billion of the stolen funds has been frozen by stablecoin issuers, including Tether, Circle, Ripple and World Liberty Financial, according to Binance and researchers. Stablecoin issuers can freeze their tokens remotely, which limits the attackers’ ability to turn them into cash, though a freeze does not by itself return the coins to Binance.

TRM Labs estimated that about $2.4 billion in bitcoin and ether is beyond reach. No company issues bitcoin or ether, and no company can freeze either one, Patrick Tan, general counsel of blockchain intelligence firm ChainArgos, told Reuters. The coins can be stopped only if the attacker sends them to an exchange or broker able and willing to freeze them, or if law enforcement obtains the private keys.

Binance said it would cover all losses from company funds and its emergency assets fund, adding that “user funds are safe.” The exchange operates a secure asset fund for users, a $1 billion bitcoin reserve meant to protect customers after a security breach, according to its website, and Teng said losses would be covered by the fund and company resources.

The FBI said Friday it is aware of the incident and is engaged with partners to understand the scope of the activity and coordinate investigative steps. The US Secret Service said its investigators are working around the clock with private-sector partners, including Circle, to identify, freeze, trace and recover the stolen funds.

Prices of bitcoin and ether fell after news of the breach, then regained some losses to trade about 2 to 3 percent lower midday Friday in Hong Kong, according to CNN. The theft tops the previous record: $1.5 billion stolen from the Bybit exchange in February 2025, an attack the FBI attributed to North Korean hackers.

Reporting based on coverage by CNN and Reuters.