Summary
Binance, the world's largest cryptocurrency exchange, disclosed a "security incident" affecting about $6.3 billion in assets. Nearly $3 billion has been frozen on-chain so far. Blockchain analytics firm Elliptic puts the total stolen at $6.43 billion, while Chainalysis estimates $5.912 billion at the time of theft. If those figures hold, this is the largest crypto heist on record, ahead of the roughly $1.5 billion Bybit theft in February 2025.
What We Know
- Frozen funds: Elliptic puts the frozen total at about $2.84 billion. Tether froze more than 1.567 billion USDT and Circle froze 800 million USDC. Together with Ripple and World Liberty Financial, stablecoin issuers froze roughly $2.67 billion. The Arbitrum Security Council froze about $30.5 million.
- Still attacker-controlled: Elliptic estimates the attacker holds about $3.33 billion across roughly 43 wallets that issuers cannot freeze, including 511,861 ETH, 18,270 BTC, 233 million XRP and 670 million TRX.
- Initial cause: Binance's early investigation pointed to a compromised DevOps engineer's laptop, which gave access to a service container that was used to submit unauthorized withdrawal transactions. Binance said there is no evidence of a wallet private key leak.
- Wider scope: Binance later said it had "uncovered additional points of breach." Co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions" and that no individual has been held responsible.
Attack Mechanics
Elliptic says the attacker appears to have made Binance's own systems sign transactions rather than stealing keys. TRM Labs reports that the attacker took over a hot wallet and, about 3 minutes 24 seconds after a delegation transaction, moved its full balance, including 167,464 ETH, 63 tokens and 1.615 billion USDT. Preparation started at least 36 hours earlier, and the attacker used 50 pre-signed authorizations so that one would match the wallet's transaction count when executed.
Attribution
TRM Labs attributes the attack with high confidence to North Korea's TraderTraitor, the group tied to the 2025 Bybit heist. Chainalysis also links it to the DPRK with high confidence, noting that stolen funds were commingled with proceeds from the Bitget exploit. Elliptic also sees North Korea-linked actors but urges caution, citing differences in laundering speed and methods and the lack of a confirmed root cause.
Binance's Response
- Temporarily suspended deposits and withdrawals during security checks
- Revoked the affected address authorization
- Engaged law enforcement and blockchain intelligence partners
- Pledged to cover all losses from its Secure Asset Fund for Users (SAFU) and company funds
- Expects withdrawals to resume within 48 hours after revamping the withdrawal service and related addresses
Why It Matters
The incident repeats a pattern from earlier large thefts: the attacker targeted the operational layer (developer endpoints, service containers, signing workflows) rather than cryptographic keys. Organizations that run signing or payment automation should treat developer workstations and the services they can reach as part of the crown-jewel attack surface.
Recommendations
- Require hardware-backed, isolated signing for high-value transactions, with out-of-band approval.
- Restrict what service containers can request, and add withdrawal limits and velocity checks that do not depend on the same system that signs.
- Harden and monitor engineer endpoints with access to production tooling.
- Pre-arrange freeze and recovery contacts with stablecoin issuers and chain security councils.
- Users should monitor official Binance channels and beware of phishing that exploits the incident.