Binance hacked for an estimated $6.3 billion in record crypto theft

Binance was reportedly hit by a cyber attack that enabled unauthorized withdrawals worth an estimated $6.3 billion. The claimed loss would be the largest cryptocurrency exchange theft reported so far. Binance said it would cover losses through its Secure Asset Fund for Users and company funds.

The exchange suspended withdrawals because it was carrying out a security revamp. Its initial investigation pointed to a compromised DevOps engineer’s laptop, which may have let an attacker reach a service container and submit unauthorized withdrawal transactions. Deposits continued normally, according to Binance.

The company said user funds were safe and that approximately $3 billion had been frozen on-chain. Tether and Circle also froze funds linked to the attack. The article does not report when withdrawals will fully resume, but the incident could increase scrutiny of exchange security and liquidity.

The reported Binance loss is approximately $6.3 billion. If accurate, that figure would make the incident the largest cryptocurrency exchange theft described in the article. Its size matters because a loss of that scale can test an exchange’s reserves, emergency controls, and ability to protect customers.

The comparison is stark. The article says a $1.5 billion hack of the Bybit exchange last year was the previous benchmark. The Binance estimate is more than four times that amount. Binance said approximately $3 billion had already been frozen on-chain, while Tether and Circle reported freezing related funds.

The final loss may depend on how much cryptocurrency can be frozen or recovered. Binance promised to cover all losses using its user protection fund and company funds. The article presents the $6.3 billion figure as an estimate, not a final audited total.

A cryptocurrency exchange is a digital marketplace that lets users buy, sell, and transfer cryptocurrencies. It matters because customers often rely on the exchange to record balances, secure assets, and process withdrawal requests. Binance is an example of a centralized exchange, meaning one company operates the platform and its security systems.

When users deposit assets, the exchange records those holdings and manages the associated blockchain addresses or wallets. A withdrawal request tells the exchange to send assets to a specified blockchain address. The exchange then authorizes and broadcasts a transaction, while the blockchain records the transfer. In Binance’s case, investigators said an attacker may have submitted unauthorized withdrawal transactions.

The article says Binance suspended withdrawals but kept deposits normal. It also says the company promised to cover losses and that user funds were safe. The incident matters because centralized exchanges create a security and solvency risk: a failure in company systems can affect many customers at once.

A DevOps engineer’s laptop may have been the first weak point in the attack. DevOps staff often work with systems that deploy or manage online services. If an attacker gains access to such a device, they may obtain credentials or tools that provide entry to connected infrastructure. The article describes this only as Binance’s initial investigation.

The suspected path ran from the laptop to a service container. A container is an isolated software environment used to run a service. If the attacker reached a container with access to withdrawal functions, they may have used that access to submit unauthorized transactions. The article does not specify which credentials or controls were bypassed.

Binance suspended withdrawals for a security revamp after the suspected attack. That response was intended to limit further movement while the company investigated and strengthened protections. The case shows why exchanges must secure employee devices, internal services, and withdrawal approval systems together, rather than treating them as separate risks.

For Binance users, the immediate effect was restricted access to withdrawals. Binance said it would cover all losses and that user funds were safe, but customers still had to wait during the security revamp. The article does not report individual losses or a final recovery amount.

The size of the theft can affect broader confidence. Investors may question whether centralized exchanges can protect assets, meet obligations, and maintain enough liquidity during a crisis. Tim Sun of HashKey Group said the incident could make investors reassess counterparty, solvency, and liquidity risks. Tether and Circle froze linked funds, which may limit further movement.

The article does not give a specific cryptocurrency price decline after the attack. It does describe the event as shocking the crypto community and potentially dampening risk appetite. Binance’s promised compensation and the freezing of approximately $3 billion on-chain may reduce losses, but the incident could bring tighter security reviews and greater scrutiny.

TraderTraitor is described as North Korea’s elite hacking unit. The group’s name appears in TRM Labs’ attribution of the Binance attack. Attribution matters because identifying an attacker can help exchanges, blockchain companies, and authorities track stolen assets and warn others about related activity.

TRM Labs said it reached the conclusion with high confidence, based on robust on-chain and off-chain intelligence. On-chain evidence concerns blockchain activity, while off-chain intelligence can include information gathered outside the blockchain. TRM Labs said it was tracking the funds and alerting partners through its Beacon Network, which monitors crypto crimes in real time.

The article says multiple reports point to North Korea, but it does not name a specific government agency or provide evidence details. Attribution therefore remains a research assessment rather than a court finding in the text. Binance’s investigation separately suggested a compromised DevOps laptop and service container may have enabled the withdrawals.

A blockchain transaction records a transfer of cryptocurrency from one address to another on a shared digital ledger. Once confirmed, the movement can usually be examined through the blockchain’s transaction history. This matters after a theft because investigators can follow where the assets go, even when ownership is difficult to identify.

In this incident, Binance said it worked with blockchain partners to freeze affected assets, with approximately $3 billion frozen on-chain. Tether and Circle also said they froze funds linked to the attack. Freezing can occur when an issuer or platform has technical or legal control over particular tokens or accounts. Other assets may continue moving if no cooperating party can stop them.

TRM Labs said it was tracking the funds and alerting partners through its Beacon Network. The article does not explain the network’s technical design. It does show the practical value of blockchain records: companies can monitor transfers, flag addresses, coordinate responses, and potentially prevent some stolen assets from being used.