Binance said hackers stole more than $6 billion in what may be the largest cryptocurrency theft on record. The incident leaves users waiting for withdrawals to resume as the exchange works to recover assets. Here is what readers need to know about the breach.
The company said it reserved more than $6.34 billion of its funds to cover the stolen assets. Binance was beginning to recover assets for users and, with blockchain partners, froze roughly $3 billion in affected assets.
What We Know About the Binance Hack
Binance said an initial investigation suggested a compromised laptop may have been involved. A later investigation uncovered additional “points of breach.” The exchange has not confirmed the criminals’ identities.
Blockchain intelligence firm TRM attributed the attack to TraderTraitor, which it described as North Korea’s elite hacking unit. TRM said an attacker moved approximately USD 6.36 billion from Binance wallets on ten blockchains, mostly in about 20 minutes. The firm said it made that judgment with high confidence.
Chainalysis also believed TraderTraitor likely carried out the attack, co-founder and CEO Jonathan Levin wrote on X. Binance said it was working with law enforcement to confirm who was responsible.
President Donald Trump said U.S. officials were investigating. Asked about possible North Korean involvement, Trump said, “We’re looking at that.” His statement did not confirm who carried out the attack.
What Users Need to Know About Recovery
Binance co-CEO Richard Teng said the company was working nonstop. He said Binance was coordinating with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen funds.
Teng said Binance’s hot wallet was affected. Hot wallets keep private keys online; cold wallets are offline and used for secure storage. He said most user assets were held in cold wallets and moved into a hot wallet only when a user made a withdrawal.
Binance said deposits were unaffected, but withdrawals had been suspended. The exchange expected them to resume in the next day or two. That was the company’s expectation, not confirmation that service had restarted.
Analyst Garrick Hileman said roughly half the stolen assets had been frozen, while hackers were transferring and converting some unrecovered funds. He compared the process to laundering goods through a mixer, where crypto is combined with other crypto to make tracking harder. He said the time needed to convert funds was unclear.
Why the Attack Is Drawing Scrutiny
NyxLab co-founder and CEO Kok Tin Gan said the incident raised questions about approval controls. He said it appeared one signature gave an attacker a never-expiring, full-access token to a Binance hot wallet. That was Gan’s assessment, not Binance’s confirmed account.
Binance said its technology and security teams were investigating. Teng said the attack involved multiple people and complex tactics, including a “self-destruct mechanism” that made the investigation harder.
TRM and other firms called this the largest cryptocurrency theft on record. Binance founder Changpeng Zhao wrote that the hack might lead in dollar value, while Mt. Gox affected more bitcoin. The report also cited the $1.5 billion Bybit hack from February of last year; the FBI said North Korea and TraderTraitor were responsible.
Readers following technology and business can also read coverage of AI coding agents, San Antonio’s business economy and semiconductor equipment maker PSK Holdings. Those reports offer related technology and business coverage without changing what is known about this breach.
The source report on the breach says Binance’s investigation and recovery work are continuing. For users, the next thing to know about is the withdrawal restart: Binance said withdrawals could resume in the next day or two.