Binance Halts Withdrawals Following Record $6.3 Billion Crypto Heist
Hackers drained approximately $6.36 billion from Binance wallets across 10 blockchains in roughly 20 minutes, marking the largest cryptocurrency theft on record, as reported. The attack prompted the world’s biggest cryptocurrency exchange to suspend withdrawals while working with blockchain partners to freeze about $3 billion of the stolen assets.
Cryptocurrency prices fell broadly across global markets following the security breach. Bitcoin hit a six-week low of $76,368, while ether dropped more than 3 percent to a two-month low of $2,178 before markets stabilized.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
How the Hack and Asset Freeze Unfolded
The unauthorized transactions began late on Thursday, with the attacker moving the vast majority of the funds out of Binance wallets in about 20 minutes, TRM Labs reported. Binance stated in an initial investigation that the incident may have involved a compromised engineer’s laptop, which allowed entry into a service container to submit unauthorized withdrawal requests. Subsequent investigations uncovered additional breach points.
Blockchain analysis firms quickly mobilized to track the stolen capital. Stablecoin issuer Tether froze nearly $1.57 billion in assets tied to the incident, while Circle froze more than $800 million. World Liberty Financial also collaborated with custodian BitGo to freeze additional funds, bringing the total recovered or frozen amount to roughly $3 billion.
User funds are safe. Binance will cover all hacking losses.Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.We will share a full post-mortem once the investigation is complete. Please…
Binance co-CEO Richard Teng confirmed on X that user funds are safe and that company reserves will cover all losses. The exchange halted withdrawals immediately following the breach, with executives projecting that withdrawal services would resume within 48 hours.
Tracing the Attack to North Korean Hackers
Two major U.S.-based blockchain intelligence firms attributed the assault to TraderTraitor, a North Korean hacking unit. TRM Labs reported with high confidence that the unit orchestrated the breach, noting that several features match earlier North Korea-linked heists, including the February 2025 theft of $1.5 billion from the Bybit exchange. Chainalysis co-founder and CEO Jonathan Levin also wrote on X that the Binance breach was likely executed by the same group.
Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.The company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj
Security experts assert that North Korea has increasingly relied on illicit cyber activities and cryptocurrency theft to acquire foreign currency. These funds support the regime’s troubled economy and help finance its nuclear program in defiance of United Nations sanctions. In December 2022, South Korea’s intelligence agency estimated that North Korean hackers had stolen about $1.1 billion in virtual assets over a five-year period.
Binance maintained that it found no evidence of any wallet private key leak and promised to release further technical details once its internal probe concludes.
Centralized Exchange Security Faces Heightened Scrutiny Following Breach
The staggering theft revives questions regarding oversight and security architectures across centralized digital asset platforms. Unlike decentralized protocols or traditional stock brokerages, centralized exchanges custody billions of dollars in digital assets on behalf of millions of registered users, heightening their exposure to sophisticated state-backed threat actors.
Binance carries a troubled regulatory history under founder Changpeng Zhao, a Canadian businessman who launched the platform in 2017. Zhao pleaded guilty in 2023 to a felony charge related to failing to maintain adequate anti-money laundering controls on the platform and subsequently stepped down as CEO. U.S. President Donald Trump pardoned Zhao in 2025. Although Zhao no longer manages daily operations, he posted on X that as a shareholder, he expects all user funds to be fully covered by the exchange.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
Remaining Funds Unrecovered as Withdrawal Services Face Temporary Suspension
How much money remains unaccounted for following the Binance breach?
While Binance and blockchain partners successfully froze or located about $3 billion of the stolen funds, the exchange has not publicly detailed the exact status or recovery path for the remaining $3.3 billion, noting that total figures may continue to shift as investigations proceed.
When do Binance users expect to access withdrawal services again?
Binance announced that deposits remained unaffected by the breach, while withdrawals were suspended with expectations of resuming normal operations within 48 hours of the initial freeze.
Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit. Thanks to all other signers involved. 💛
Which specific hacking unit has been blamed for the theft?
Blockchain analysis firms TRM Labs and Chainalysis attributed the attack to TraderTraitor, a North Korean hacking unit identified in previous major digital asset heists.