Binance hit by what could be the largest crypto hack in history

Binance, the world's largest cryptocurrency exchange, says it is investigating a security incident that affected roughly $6.3 billion in crypto assets. About $3 billion has been frozen so far, and the figure is expected to rise as investigators trace more of the stolen funds. If the numbers hold, this would be the largest crypto heist in history by a wide margin: the previous record was the $1.5 billion taken from Bybit in February 2025.

This is a developing story. What follows is what has been confirmed by Binance or by reputable outlets so far, and what remains unknown.

What is confirmed

The incident is real, and Binance is on record. Binance said on Thursday that a security incident had affected roughly $6.3 billion in crypto assets, and that it had temporarily suspended all deposits and withdrawals while its teams run security checks, freeze funds, and work with law enforcement. Trading on its Binance Alpha platform was also suspended as a precaution.

Billions are frozen, and the tally is moving. Binance says about $3 billion has been located and frozen, and expects that number to grow as it works with law enforcement, token issuers, blockchain intelligence firms, and other industry partners. Stablecoin issuers moved fast: Tether froze nearly $1.57 billion in USDT, Circle froze more than $800 million in USDC, Ripple froze roughly $200 million, and the issuer of FDUSD froze stolen FDUSD. World Liberty Financial said it worked with custodian BitGo to freeze $27 million in stablecoins and about $2 million in its own tokens.

The early theory is a compromised engineer laptop. Binance's initial investigation suggested a hacker gained access to an engineer's compromised laptop, which let the attacker reach one of its systems and make unauthorised withdrawals. Changpeng Zhao, Binance's founder and majority shareholder (who no longer runs the company), said on X that the incident "does look like a hack".

Independent estimates put the theft around $5.9 billion. Blockchain analytics firm Chainalysis estimated the amount stolen at approximately $5.912 billion at the time of the theft. Arkham CEO Miguel Morel said on-chain data indicated billions had been hacked from Binance, with the incident appearing to begin around 4:30 pm EDT.

Binance says users will be made whole. Co-founder Yi He said the company would cover all losses, and Binance has said user funds are safe. The exchange runs a Secure Asset Fund for Users, a bitcoin reserve held specifically for security breaches.

Attribution is already being claimed. TRM, a blockchain intelligence firm, said it assessed with "high confidence" that the attack was carried out by North Korea's TraderTraitor unit, which investigators link to the Lazarus Group. The Bybit hack was likewise attributed to North Korea-linked actors.

What is not confirmed

The final amount. $6.3 billion is Binance's own estimate of the impact, and $5.912 billion is Chainalysis's estimate of what was stolen. The frozen $3 billion is what has been recovered or blocked so far. These numbers will keep shifting.

The exact attack path. A compromised laptop is the leading theory from Binance's initial investigation, not a confirmed root cause. No technical details of the intrusion have been released by Binance or any security firm.

Attribution. TRM's North Korea assessment is one firm's finding at high confidence. No law enforcement agency has publicly confirmed the attribution.

The market felt it immediately

Bitcoin fell roughly 3 to 5 percent, dropping below $77,000 at one point, ether fell, and BNB, the token tied to the Binance ecosystem, dropped nearly 10 percent. More than $1 billion in leveraged futures bets were liquidated as prices fell.

The engineering takeaway

No AI angle here, just an old lesson getting a very expensive reminder: the initial vector was not a novel exploit. It was a privileged engineer's compromised laptop. Credential hygiene, device security, and the principle that no single machine should be able to move billions are not glamorous topics. They are the topics that decide whether an incident report is a paragraph or a nine-digit number.

If you run infrastructure, the checklist is short: hardware security keys on every privileged account, separation between the machine that browses and the machine that can move money, and alerting on withdrawals that do not match any human's intent. The sophisticated part of this attack, if attribution holds, was the persistence to reach the laptop. The expensive part was everything the laptop was allowed to do afterwards.