‘Biggest hack in history’: Crypto giant freezes assets after $8.9b heist

Hackers stole $6.3 billion ($8.9 billion) from Binance, the world’s largest cryptocurrency exchange. Analysts called it potentially the biggest crypto hack ever. The attack affected Binance wallets across 10 blockchains. Binance temporarily suspended deposits and withdrawals while investigating and securing its wallet systems.

The attackers shifted most of the funds in about 20 minutes, according to TRM Labs. An initial Binance investigation suggested a hacked laptop belonging to an engineer gave attackers access to one of the company’s systems. They then used that access to make unauthorised withdrawals and move the assets through blockchain addresses.

Binance said partners had frozen about $3 billion so far, while the status of the remaining $3.3 billion was unclear. Tether and Circle also froze linked assets. Binance co-founder Yi He said the company would cover all hacking losses, and Binance said user funds remained safe.

A cryptocurrency exchange is a digital marketplace where people buy, sell and trade cryptocurrencies. Binance provides those services globally. It also holds digital assets in wallets connected to its platform, so users can trade without personally managing every transfer or wallet operation.

This arrangement is called custody. Binance’s systems hold or control assets on users’ behalf, which helps the exchange process trades and withdrawals. It also creates a major security responsibility. If attackers access exchange systems or wallets, they may be able to withdraw assets without users approving each transaction.

Binance had 335 million registered users globally and about $162.8 billion in assets under custody, according to its 2025 annual report. After the hack, it suspended deposits and withdrawals as a precaution. It said user funds remained safe and that its teams were checking wallet infrastructure and tracing affected assets.

The reported theft total was $6.3 billion, also written as $8.9 billion in the article’s currency conversion. That scale made the incident a possible record for cryptocurrency theft. Binance said the attack affected wallets operating across 10 blockchains and that most funds moved rapidly.

Binance said it had worked with partners to freeze about $3 billion in affected assets. The company gave no update on the remaining $3.3 billion at that point. Tether separately said it froze nearly $1.57 billion linked to the incident, while Circle froze more than $800 million.

The stolen amount was large compared with Binance’s overall custody business. Its 2025 annual report listed about $162.8 billion in assets under custody. Binance also runs a secure asset fund held entirely in bitcoin, intended to protect users during security breaches, and said it would cover all hacking losses.

Some cryptocurrency tokens, especially stablecoins, are issued and managed by companies rather than existing as completely uncontrolled software. Those issuers can build administrative controls into their token systems. Such controls may let them block transfers from particular addresses or prevent tokens from being redeemed.

That mechanism allows an issuer to react when blockchain investigators identify stolen funds. Tether said it had frozen nearly $1.57 billion in assets linked to the Binance incident. Circle reported freezing more than $800 million. The tokens remain visible on the blockchain, but transfers involving blocked addresses can be restricted.

This power does not apply equally to every cryptocurrency. Bitcoin, for example, is not described in the article as being frozen by an issuer. The incident shows how cooperation between exchanges, token companies, blockchain analysts and law enforcement can limit the movement of some stolen assets, although it may not recover everything.

TRM Labs and Chainalysis attributed the attack to North Korea. TRM said several features matched earlier heists linked to Pyongyang, including the 2025 Bybit exchange hack that the FBI attributed to North Korea. TRM said it made the judgment with high confidence.

Blockchain analysis firms examine transaction records, wallet addresses and the routes stolen funds take across networks. They can compare timing, movement patterns and laundering methods with activity seen in earlier attacks. In this case, TRM said attackers targeted wallets on 10 blockchains and shifted most funds within about 20 minutes.

This evidence can support attribution, but it does not necessarily reveal a person’s name. Arkham chief executive Miguel Morel said billions appeared to have been hacked by an unknown actor. The article therefore distinguishes between a high-confidence link to North Korea and uncertainty about the specific attacker.

A hack of this size can damage cryptocurrency markets in two ways. Directly, traders may sell because they fear further losses. Indirectly, the breach can weaken confidence in exchanges that hold assets for customers. Analysts said the incident could make investors reassess counterparty, solvency and liquidity risks.

Markets reacted quickly. Bitcoin fell more than 3 per cent to a six-week low of $76,368, while ether dropped more than 3 per cent to a two-month low of $2,178. The crypto market was already under pressure from higher US interest rates and softer demand from exchange-traded fund buyers.

The longer-term effect could be reduced risk appetite and greater scrutiny of centralised exchanges. Bernardo Brites of Trace Finance said users may leave smaller and medium-sized exchanges because they may not cover a major hack. Binance said user funds remained safe and that it would cover all hacking losses.

In general, a blockchain is a shared digital record of transactions. A crypto wallet provides access to assets recorded on that network, while a private key is the secret credential used to authorise transfers. This system lets owners send assets directly to another wallet without a traditional bank approving each transaction.

The key mechanism is control. Whoever obtains the relevant private key or gains access to a system that can authorise withdrawals may be able to move assets. In the Binance case, investigators suspected a hacked engineer’s laptop helped attackers access a company system. Most funds were then shifted across 10 blockchains in about 20 minutes.

Blockchains make transfers traceable, but recovery can still be difficult. Assets may pass through many wallets and networks, and some cryptocurrencies cannot be frozen by an issuer. Binance and its partners had frozen about $3 billion, while the status of the remaining $3.3 billion was unclear.