Hackers drained $6.3 billion in cryptocurrency from the world’s largest exchange, Binance, during a rapid 20-minute breach, according to analyses from TRM Labs cited by E24.
The staggering theft surpasses the previous record set in February 2025, when hackers with connection to North Korea stole $1.5 billion from the exchange Bybit.
How the Attack Unfolded Across Eight Blockchains
The cyberattack began after perpetrators prepared for at least 36 hours, according to NRK. The attackers gained unauthorized access and moved billions of dollars across eight blockchain networks in approximately 15 minutes, as detailed by Ari Redbord of TRM Labs.
Initial investigations by Binance suggested that the hackers may have compromised a developer’s laptop to infiltrate the systems, though the exchange reported finding multiple entry points without any evidence that private keys were leaked. Binance CEO Richard Teng later stated that the attackers simply did not use an employee’s credentials, pointing instead to a more complex process reported by VG.
The breach impacted Binance.com, while leaving the separate platform Binance.US untouched, VG noted. Binance subsequently suspended deposits and withdrawals while rebuilding its withdrawal system, with plans to restore customer access, according to E24 and Financial Times reports.
Analytical firms link crypto theft to North Korea
Analytical firms TRM Labs, Chainalysis, and Elliptic all point to North Korea as the responsible party, according to E24. TRM Labs specifically tied the operation to the hacker group TraderTraitor, the same collective implicated in the Bybit breach by the FBI.
Pangolin Intelligence also linked the blockchain activity to North Korean actors, while Dagbladet noted that the regime relies on such cyber operations to bypass international sanctions and fund its weapons programs. In March, North Korea’s Ministry of Foreign Affairs dismissed global allegations of digital thefts as “absurd slander,” as reported by the Wall Street Journal and cited by E24.
Government officials have raised alarms regarding the broader implications of the theft. Astri Aas-Hansen warned that the stolen funds could finance illegal goods, criminal networks, and authoritarian regimes, telling VG that the incident demonstrates why Norway must prioritize national cybersecurity.
Binance co-founders confirm commitment to customer reimbursals
Co-founder Yi He confirmed the company’s commitment to reimbursals, while co-founder Changpeng Zhao estimated the loss on X to be slightly over $1 billion, contrasting with larger estimates from chain analysts.
Out of the $6.3 billion taken, approximately $3 billion has been successfully frozen through collaborative efforts with platforms like Circle and Tether, as reported by Dagbladet. However, analysts note that the hackers retain control of remaining assets in digital currencies that cannot be frozen.
Binance’s emergency insurance fund, SAFU, held roughly $1 billion in Bitcoin earlier in the month, falling well short of the total stolen amount. Consequently, the exchange is advancing funds to customers while awaiting the eventual release of the frozen funds.
Bitcoin drops below $77,000 following security breach
The security breach sent immediate shockwaves through the digital asset market. Bitcoin dropped below $77,000 for the first time in over a month, reaching a low of $76,264 on Friday before staging a partial recovery, according to E24.
ViaBTC chief analyst Jeff Ko told Bloomberg that a pre-existing weak market sentiment accelerated the sell-off. Meanwhile, Miller Tabak market strategist Matt Maley expressed concern that heightened security risks could deter institutional investors from participating in the cryptocurrency market.
Frequently Asked Questions About the Binance Breach
Which exchange was targeted in the attack?
The attack targeted Binance.com, the world’s largest cryptocurrency exchange, while the separate platform Binance.US remained unaffected, according to VG.
How much cryptocurrency was stolen?
Cryptocurrency valued at $6.3 billion was impacted during the breach, with approximately $3 billion subsequently frozen through platform cooperation.
Who is suspected of orchestrating the cyberattack?
Analytics firms TRM Labs, Chainalysis, and Elliptic attribute the attack to the North Korean hacker group TraderTraitor, as detailed by E24.
When are withdrawals expected to resume for customers?
Binance paused deposits and withdrawals while rebuilding its system, with a stated goal of allowing customers to access their funds again Sunday, as reported by E24 and the Financial Times.
Keep reading