Vulnerabilities
Binance loses $6.3bn in record crypto heist, half of funds frozen
Hackers stole $6.3 billion from Binance in the largest crypto theft ever. About half the stolen funds were frozen, but billions remain unrecovered.
Ross Grant3 min read
The short version
Hackers broke into Binance and stole $6.3 billion in cryptocurrency, the biggest theft in crypto history. About half of the stolen coins have been frozen, but billions are still missing. Binance says customers will not lose money and is working with authorities to recover the funds. The company has paused withdrawals while it investigates.
By the numbers
- $6.3bntotal stolen from Binance in the hackInfosecurity Magazine
- $3bnstolen funds frozen by issuers and partnersFrance 24
- $2.9bntotal stolen in nearly 150 crypto incidents last yearFrance 24
What happened?
Hackers stole $6.3 billion in cryptocurrency from Binance, making it the largest digital asset theft to date. About half of the stolen funds, mainly stablecoins, were frozen by their issuers. Binance has suspended withdrawals and is working with law enforcement and blockchain firms to recover assets. The company says it will cover all customer losses.
What was taken
Hackers stole $6.3 billion worth of cryptocurrency from Binance, according to the company and multiple blockchain analysis firms. This is the largest theft in the history of digital assets. About half of the stolen funds were stablecoins, such as Tether (USDT) and Circle (USDC), which have since been frozen by their issuers. The rest, including bitcoin and ether, cannot be frozen and are likely out of reach unless law enforcement can seize the private keys or the attackers try to cash out through a cooperative exchange. Binance has said it will cover all customer losses using its Secure Asset Fund for Users (SAFU) and company funds.Infosecurity Magazine (opens in a new tab) France 24 (opens in a new tab)
How the attack worked
Binance initially believed the attackers got in through a compromised laptop belonging to a DevOps engineer. This may have let them access a service container and submit unauthorised withdrawal transactions. Later, Binance said its investigation found more points of breach but did not give details. TRM Labs, a blockchain analytics firm, said the attackers compromised Binance's signing infrastructure, which authorises transactions. This allowed them to issue instructions that emptied the affected wallets. The theft happened quickly, with most funds taken in about 20 minutes. Once the money was moved, the attackers tried to shift it beyond the reach of Binance and stablecoin issuers.
The response
Binance froze $3 billion of the stolen funds, mainly stablecoins, with help from token issuers and industry partners. The company suspended all deposits and withdrawals while it investigated and revamped its withdrawal systems. Deposits have since resumed, but withdrawals remain paused at the time of writing. Binance has revoked authorisation for the affected addresses and is working with law enforcement and blockchain intelligence firms to trace and recover assets. The company has repeatedly said that customer funds are safe and promised to publish a detailed technical report once the investigation is complete. Customers are warned to avoid scams exploiting the incident and to rely only on official Binance channels for updates.
Who is behind it
Three blockchain analysis firms, TRM Labs, Elliptic, and Chainalysis, have attributed the attack with high confidence to TraderTraitor, a North Korean hacking group. Binance itself has not named the attackers, and North Korea routinely denies involvement in such incidents. The US FBI previously linked similar attacks to North Korean groups, but no law enforcement agency has confirmed responsibility in this case.
Has this happened before?
Large-scale crypto thefts have happened before, but never on this scale. According to TRM Labs, $2.9 billion was stolen across nearly 150 incidents last year. The attack on Binance shares similarities with previous breaches at Bybit and Bitget, which were also linked to North Korean hackers.
What you should do
Binance customers should be alert for phishing attempts and scams related to the breach. Only trust information from official Binance channels and do not respond to unsolicited messages or links. If you have questions, contact Binance Customer Support directly.
Claimed vs confirmed
- Unconfirmed
Three blockchain firms attribute the attack to North Korean group TraderTraitor.
TRM Labs, Elliptic, and Chainalysis say the attack matches previous North Korean operations, but Binance and law enforcement have not confirmed this.
Why it matters
This is the largest crypto theft ever, showing that even major exchanges can be targeted. The incident highlights the risks of digital assets and the importance of rapid response and asset freezing. It also raises questions about the security of transaction authorisation systems.
Key points
- $6.3 billion stolen from Binance in the largest crypto hack ever
- About half the stolen funds, mainly stablecoins, were frozen
- Attackers compromised transaction signing systems
- Binance will cover all customer losses using its reserve fund
- Three blockchain firms link the attack to North Korean hackers
Sources
Infosecurity Magazine
Reference
France 24
Reference
