Binance will cover all customer losses following a record-breaking hack that saw US$6.3 billion (NZ$11.2 billion) stolen from the world’s largest cryptocurrency exchange. The exchange has suspended withdrawals, which it expects to resume within 48 hours, and has set aside company funds to ensure users are made whole.
Blockchain intelligence firms TRM Labs, Chainalysis, and Elliptic have attributed the theft to TraderTraitor, an elite hacking unit based in North Korea. TRM Labs stated it made this judgment with “high confidence,” noting that the bulk of the heist occurred in about 20 minutes across ten different blockchains.
Coinbase is safe and secure.We’re actively monitoring the Binance situation, and have reached out to their team to offer our support.
North Korean unit TraderTraitor linked to record theft
The scale of the breach dwarfs previous cryptocurrency thefts. The US$6.3 billion loss is significantly larger than the US$1.5 billion stolen from the Bybit exchange. Tom Robinson, chief scientist at Elliptic, described the incident as almost certainly the largest theft of any kind in history.
TRM Labs reported that the attack mirrored the 2025 Bybit heist, which the FBI also attributed to North Korea. Chainalysis CEO Jonathan Levin wrote on X that the breach was likely the work of the DPRK group. Experts noted that North Korea utilizes state-linked cyber units to generate foreign currency to fund its nuclear program and support a troubled economy under UN sanctions.
Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.The company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj
Did you know? South Korea’s spy agency reported in December 2022 that North Korean hackers stole an estimated 1.5 trillion won in virtual assets over a five-year period, with more than half of that occurring in 2022 alone.
Compromised laptop provided entry point
Binance stated on X that an initial investigation pointed to a compromised laptop belonging to one of its engineers. This breach may have allowed attackers to gain system access and execute unauthorized withdrawals. However, the company later added that subsequent probes uncovered additional “points of breach.”
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
The exchange denied that any wallet private keys were leaked. This contradicts an analysis by NyxLab CEO Kok Tin Gan, who suggested the attacker may have obtained a “never-expiring, full-access token” to a Binance hot wallet—wallets connected to the internet that hold private keys.
Binance freezes assets as cryptocurrency prices dip
Binance worked with blockchain partners to freeze roughly US$3 billion in affected assets. While the company has allocated over US$6.3 billion to cover losses, Binance did not specify the status of the remaining assets not yet located.
User funds are safe. Binance will cover all hacking losses.Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.We will share a full post-mortem once the investigation is complete. Please…
The news triggered an immediate dip in cryptocurrency prices. Bitcoin fell to a six-week low of US$76,368, and ether dropped more than 3 percent to a two-month low of US$2,178, according to GSR analyst Aravind Srinivasan. BNB, the token used for Binance fees, fell 5.3 percent to US$699.54, CoinGecko data showed.
| Exchange | Estimated Loss | Attributed Actor |
|---|---|---|
| Binance | US$6.3 Billion | TraderTraitor (DPRK) |
| Bybit | US$1.5 Billion | TraderTraitor (DPRK) |
| Bitget | US$387 Million | Pyongyang-linked |
Changpeng Zhao defends funds amid ongoing legal challenges
Founder Changpeng Zhao, known as CZ, posted on X that user funds are safe and expressed his expectation as a shareholder that all funds be covered. Zhao founded the company in 2017 but stepped down as CEO in 2023 after pleading guilty to failing to prevent money laundering. He was later pardoned by US President Donald Trump in 2025.
Binance continues to face legal challenges, including accusations in the US regarding the sale of unregistered securities and suspicions in France regarding the oversight of client funds. The company recently partially suspended operations in the European Union after failing to obtain authorization under MiCA regulations.
Pro Tip: To avoid exchange-related risks, some investors use “self-custody” via hardware wallets, which are not connected to the internet and allow the user to control their own private keys.
Binance heist frequently asked questions
Will I get my money back?
Binance has stated it will cover all losses and has set aside company funds for this purpose.
When can I withdraw my funds?
Withdrawals are currently suspended, but Binance expects to resume these services within the next 48 hours.
How did the hackers get in?
Binance’s initial investigation suggests a compromised laptop belonging to an engineer was the entry point, though other “points of breach” were later identified.
A Binance spokesperson stated the company is working with law enforcement to confirm the identity of the criminals, though the firm has not officially attributed the attack to any specific individual or state.
North Korean hacking group TraderTraitor is accused of stealing $6.36 billion from Binance in the largest cryptocurrency theft on record, according to blockchain intelligence firm TRM Labs.
More on Binance
Worth a look