Binance, the world’s largest cryptocurrency exchange, is fighting to recover funds after hackers drained an estimated $6.3 billion from its wallets in what analysts believe is the largest crypto theft—and possibly the largest financial heist—on record. The bulk of the money moved in roughly 20 minutes late Thursday, spreading across Bitcoin, Ethereum, Tron, Ripple and several Layer-2 networks.
The exchange has suspended deposits and withdrawals while it conducts security checks, traces stolen assets and works with law enforcement. Binance says about $3 billion has been frozen on-chain so far, and it has pledged to cover all customer losses from company funds and an emergency assets fund.
How the breach unfolded
Binance’s initial investigation pointed to a compromised laptop belonging to a DevOps engineer. The company said that access allowed an attacker to enter a service container and submit unauthorized withdrawal transactions; it later said it had found additional “points of breach.”
Co-CEO Richard Teng described the incident as a complex attack involving more than one person, malicious software designed to erase evidence, and manipulation of a transaction-approval system that let funds leave a Binance-controlled “hot” wallet without passing normal approval controls. Binance has said it found no evidence that wallet private keys were leaked.
Who is suspected
Multiple blockchain-analysis firms, including TRM Labs and Chainalysis, say the attack bears the hallmarks of a North Korean-linked hacking group. TRM has attributed it to TraderTraitor, which it describes as an elite North Korean hacking unit.
Neither Binance nor U.S. authorities have formally assigned responsibility. The FBI said it is aware of the incident and is coordinating with public and private partners to assess its scope, while the U.S. Secret Service said investigators are working with companies including Circle to identify, freeze and recover stolen funds.
Industry rallies—and worries
The response from crypto companies has been unusually fast. Stablecoin issuer Tether said it froze nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million in USDC. Binance said those freezes, along with work by blockchain-intelligence firms and other exchanges, have disrupted the movement of stolen funds.
Coinbase CEO Brian Armstrong said his company contacted Binance to offer help and was blocking transfers to compromised wallets. Binance founder Changpeng Zhao said recovery efforts had begun and thanked international partners for their assistance.
But analysts warn that freezing assets is only the first step. Recovery depends on tracing funds through mixers, cross-chain transfers and laundering networks before attackers can convert them into spendable money.
Experts: confidence is the real casualty
Market analysts say the immediate danger may not be a shortfall in customer assets, because Binance has promised to make users whole. The greater risk, they argue, is a loss of confidence that could accelerate withdrawals, strain counterparties and force a broader deleveraging across crypto markets.
“It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges,” said Tim Sun, senior researcher at HashKey Group. Aravind Srinivasan of market maker GSR called it “the biggest hack in history.”
Security specialists say the episode also raises uncomfortable questions about operational controls at an exchange that handles institutional-scale assets. If a single compromised endpoint and manipulated approval workflow can enable billions in withdrawals, they argue, the industry’s security model needs more than reimbursement promises.
What comes next
Binance says it expects to resume withdrawals within days, is conducting a full security review, and plans to publish a technical postmortem once its investigation is complete. It has also said it will provide an initial proof-of-reserves snapshot, with results expected by Monday.
For now, the hack has become a stress test for crypto’s central promise: that assets can move instantly across borders, but still be protected when things go wrong. Whether Binance recovers most of the stolen funds may matter less than whether it can convince users and institutions that the next breach will not be this easy.
