Cryptocurrency exchange Binance suffered an estimated $6.3 billion theft on Thursday, the largest crypto heist on record, after an attacker drained wallets the exchange uses to process transactions — most of it in about 20 minutes.
What happened
Binance said late on Thursday that approximately $6.3 billion was affected. Founder Changpeng Zhao, known as CZ, wrote on X that “user funds are safe” but added that the theft “does look like a hack on Binance.” The exchange said it would cover all losses from its Secure Asset Fund for Users (SAFU) — a $1 billion bitcoin reserve designed to protect customers after a breach — and from company resources.
According to U.S. blockchain intelligence firm TRM Labs, the attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it in roughly 20 minutes beginning at 4:05 p.m. Eastern time on Thursday. Binance’s preliminary explanation is that a compromised DevOps engineer’s laptop may have given the attacker access to a service container used to submit unauthorized withdrawal transactions. The exchange said it had found no evidence of a wallet private key leak, and that a full technical post-mortem would follow.
Where the money went
About half the stolen assets have been frozen — roughly $3 billion, according to Binance — but freezing is not the same as recovery. Stablecoin issuers including Tether and Circle can block their own tokens: CZ credited Tether with freezing about $971 million and Circle with about $823 million. Those frozen coins cannot be moved by the attacker, but they have not necessarily been returned to Binance.
The harder part is the rest. TRM estimated that about $2.4 billion worth of bitcoin and ether is beyond the reach of freezes, because no issuer can block those assets — they can only be stopped if the attacker sends them to an exchange or broker willing to freeze them, or if law enforcement obtains the private keys. CoinDesk reported that the hacker had split about $1.4 billion in bitcoin across 19 wallets.
| Figure | Amount | Source |
|---|---|---|
| Total estimated drained | About $6.3 billion | Binance; TRM Labs ($6.36 billion) |
| Frozen so far | About $3 billion | Binance, with blockchain partners |
| Bitcoin and ether beyond reach | About $2.4 billion | TRM Labs estimate |
| Previous record theft | $1.5 billion (Bybit, 2025) | Industry reports |
Who investigators blame
TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, citing blockchain activity and additional intelligence, including small Tornado Cash withdrawals used to fund an operator wallet and transaction signatures obtained before the coordinated burst of activity. Chainalysis, another U.S. blockchain analytics firm, also assessed TraderTraitor as the likely culprit, and Reuters reported that investigators had confirmed at least $5.912 billion stolen as of 8:30 p.m. Eastern on Thursday.
That attribution is an assessment by private investigators, not a publicly confirmed government determination, and the investigation into the cause is continuing. But if it holds, it would extend a long pattern: North Korean-linked groups have been blamed for some of the largest crypto thefts of recent years, using the proceeds, according to U.S. officials in past cases, to fund the regime’s weapons programmes.
What happens to customers
Binance initially suspended deposits and withdrawals while it investigated. Its later update said deposits were operating normally, but withdrawals would remain paused during a rebuild of the withdrawal service and its associated addresses, with a target of resuming within 48 hours — a target, not a confirmation that access has returned.
For ordinary users, the immediate message from Binance is that losses will be covered and user funds are safe. For the industry, the questions are harder: how a single compromised laptop could unlock withdrawals on this scale, and whether exchanges that process billions a day have controls to match. The answers will come in Binance’s promised post-mortem — and in how much of the unfrozen $2.4 billion investigators can still trace.
Sources: Binance (official X statements); TRM Labs; Chainalysis; Reuters; The Hindu Business Line; Engadget; CoinDesk.
