Binance, the world’s largest cryptocurrency exchange, confirmed a cyberattack whose impact is estimated at 6.3 billion dollars. The incident could become the largest cryptocurrency theft ever recorded. The company claims to have already frozen almost $3 billion in assets and promises to cover all of its clients’ losses.
A record cyberattack for a crypto platform
The first signs of the hack emerged a few hours ago when unusual movements of several billion dollars were detected in wallets associated with Binance. Transaction analyzes notably reported transfers from various wallets on the platform to addresses controlled by a suspected hacker. Initial estimates evolved throughout the investigations, before Binance reported a total impact of $6.3 billion.
Of this sum, around $3 billion in assets were frozen on the blockchain thanks to Binance’s cooperation with various industry players. Stablecoin issuers Tether (USDT) and Circle notably blocked funds associated with suspicious addresses. The frozen amounts include approximately $2.3 billion in USDT and USDC. The freeze prevents transfers from the affected addresses, but does not mean that all funds have already been recovered.
Binance’s preliminary investigation provides a first element of the method used. It is possible that the hacker began by compromising the laptop of a DevOps engineer, a specialist responsible in particular for the maintenance and operation of technical infrastructures. The attacker then allegedly gained access to an internal services container that allowed him to submit unauthorized withdrawal requests. Binance specifies that it has not found evidence of a leak of the private keys of its wallets.
Accusations against North Korean hackers
According to the first elements reported, the hacker would not necessarily have taken control of the keys that give direct access to the wallets. He allegedly leveraged inside access to trigger fraudulent withdrawal transactions. However, this is only one line of research. Binance says a detailed technical report will be published once the facts have been verified.
Several companies specializing in blockchain analysis suspect a group linked to North Korea. TRM Labs attributes the attack to TraderTraitor, a North Korean hacking group, based on transaction details and other intelligence. The company says it has a high level of confidence in this attribution. Chainalysis and several experts have also mentioned this route. Binance, however, has not officially confirmed the identity of those responsible.
Binance promises to refund users
In response to the incident, Binance temporarily suspended deposits and withdrawals while it secures its systems and performs necessary verifications. The company says that its users’ crypto funds remain safe and that it will cover all losses related to the hack, mobilizing its SAFU emergency fund and its own resources. The company also plans to release new proof of reserves once the incident is resolved.
The shock also affected the cryptocurrency markets. At the time of the first reports, bitcoin had fallen below $77,000, while Ether and BNB were also falling. Beyond potential losses, this case highlights the risks associated with holding billions of dollars of digital assets in the centralized infrastructures of large platforms.
With an impact of $6.3 billion, the case far exceeds the February 2025 Bybit hack, during which $1.4 billion was stolen. However, the final amount of the losses and the part that can be recovered remains to be determined. Binance promises to release more details once its investigation is complete.
