Binance hack explained: how about $6.3 billion was taken — and $3 billion frozen
Binance, the world's largest crypto exchange, says about $6.3 billion was taken in a suspected hack on Thursday — likely the biggest crypto theft on record — while about $3 billion has already been frozen and user losses will be covered.
Binance, the world's largest cryptocurrency exchange, revealed on Thursday that it had suffered a suspected hack that investigators believe may be the largest crypto theft in history. Binance estimates about $6.3 billion in assets were taken; blockchain analytics firm Chainalysis puts the amount stolen at roughly $5.9 billion at the time of the theft — around four times the sum taken from the Bybit exchange in 2025. The final loss is still not confirmed.
So how did it happen? According to Binance's initial investigation, the trail leads not to the exchange's main vaults but to a person: an attacker appears to have used a compromised DevOps engineer's laptop to reach an internal service system and submit unauthorised withdrawal transactions. Binance says it has found no evidence that any wallet private key leaked. Independent security firms have offered their own early theories — including misuse of the system that signs transactions — and the exchange says a full technical post-mortem will follow once the investigation is complete.
The response has moved almost as fast as the theft. Binance says the verified total of frozen assets has reached $3 billion, and it could rise as tracing continues. Stablecoin issuer Tether has frozen more than $1.57 billion of its USDT token, Circle has frozen over $800 million of USDC, Ripple has frozen roughly $200 million, and the Arbitrum network's Security Council froze tens of millions more held in a suspect wallet. The attacker's wallets at one point held more than $5.7 billion of the stolen assets, including nearly $1.5 billion in bitcoin, according to analytics firm Arkham.
For ordinary users, Binance's message has been consistent: customer funds are safe and the exchange will cover all hacking losses. Co-founder Yi He repeated that pledge on Friday, and founder Changpeng Zhao said the incident "looked like a hack" while also saying he expected customer funds to be fully covered. As a precaution, all deposits and withdrawals were suspended while security checks are carried out, and Binance says they will resume once the issue is fully resolved.
Investigators are also pointing to a familiar suspect. Blockchain intelligence firm TRM Labs says it assesses with high confidence that the attack was carried out by TraderTraitor, a North Korean state hacking unit linked to the Lazarus Group — an assessment, not yet a proven fact. The shock was felt across crypto markets immediately, with bitcoin falling about 3.2% on Thursday evening to below $79,000. What happens next rests on three things: how much more of the stolen money can be frozen before it is laundered, what Binance's post-mortem reveals about the engineer's laptop, and when withdrawals reopen.
This post is market news information only, not financial advice.
