Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen

Binance suffered a security incident in which attackers moved cryptocurrency from a hot wallet to an address they controlled. It is called a heist because the unauthorized transfers removed assets belonging to Binance or its users, with Chainalysis estimating about $5.912 billion stolen at the time of theft. The scale makes it the largest recorded crypto theft.

The suspected route involved a compromised DevOps engineer’s laptop and access to a service container. Investigators say the attacker prepared 50 authorizations, then used one valid authorization to direct the hot wallet to a sweeper contract. The wallet ultimately sent 167,464 ETH and 63 tokens, including 1.615 billion USDT.

Binance froze deposits and withdrawals, revoked address authorization, and began tracing funds with law enforcement and blockchain firms. It said no private key leak was found and promised to cover losses. TRM Labs and Chainalysis linked the activity to North Korea-linked actors.

Binance said the security incident affected about $6.3 billion worth of assets. Chainalysis separately estimated the amount stolen at approximately $5.912 billion at the time of theft. The difference reflects the distinction between assets affected and the amount investigators currently classify as stolen. Nearly $3 billion had been frozen on-chain.

The stolen transfer included 167,464 ETH and 63 tokens, including 1.615 billion USDT. Tether froze more than 1.567 billion USDT, Circle froze 800 million USDC, and Arbitrum’s Security Council froze about $30.5 million. These actions reduced how much of the affected money could move.

The theft surpassed the approximately $1.5 billion taken from Bybit in February 2025. Chainalysis called Binance’s loss nearly four times the next-largest crypto heist. TRM Labs and Chainalysis both linked the operation with high confidence to North Korea-linked actors, including TraderTraitor.

When deposits and withdrawals are suspended, customers cannot add cryptocurrency to Binance or send it out through the platform. Trading access may be separate, but the article specifically describes a pause on moving funds while Binance investigates. This limits further unauthorized transfers and gives security teams time to inspect systems and addresses.

Binance said it temporarily suspended both activities while security checks were completed. It also revoked the affected address authorization and engaged law enforcement and blockchain intelligence partners. The suspected attack involved unauthorized withdrawal transactions from a hot wallet, so stopping withdrawals directly addressed the suspected pathway.

Binance expected withdrawals to resume within 48 hours, after completing a security revamp of the withdrawal service and related addresses. The pause can inconvenience legitimate customers, but it helps contain an incident while investigators trace funds. Binance also said it would cover losses through SAFU and its own funds.

A hot wallet is a wallet kept connected to online services so an exchange can process withdrawals quickly. That convenience also creates a security target. In this incident, Binance said there was no evidence that a wallet private key had leaked, but investigators suspected attackers gained access to the system that requests or handles signatures.

TRM Labs described 50 authorizations signed by the Binance hot wallet and aimed at a sweeper contract. The attacker prepared signatures for 50 consecutive nonce counts, because the wallet’s transaction count kept changing. One authorization matched the current count. Three minutes and 24 seconds later, the operator ordered the wallet to send its full balance away.

The likely weakness was access to the signing system, not direct possession of the key. Binance said the initial investigation pointed to a compromised DevOps laptop and service container. The company had not published a root cause, so this mechanism remains investigators’ most likely explanation.

Freezing cryptocurrency usually means preventing a particular address from transferring specific tokens. Many widely used tokens are controlled by smart contracts whose issuers can blacklist addresses or block transfers. Some blockchain networks or governing councils can also act through special controls. This matters because it can stop stolen assets after they leave an exchange.

Tether said it froze more than 1.567 billion USDT, while Circle froze 800 million USDC related to the incident. The Arbitrum Security Council reportedly executed a transaction freezing about $30.5 million from the Binance exploit. These actions work only where the token or network design gives an issuer or authority that power.

The freezes do not automatically recover every stolen asset. Investigators still need to trace movements, identify controlled addresses, and pursue recovery. Binance engaged law enforcement and blockchain intelligence partners. The article also says Ripple and World Liberty Financial participated in freezes, bringing the reported total to about $2.67 billion before the text ends.

TRM Labs attributed the Binance hack to North Korean threat actors with high confidence. It linked the operation to TraderTraitor, the group also associated with the 2025 Bybit heist. Chainalysis independently linked the incident to the DPRK after observing Binance-theft funds commingling with funds from a recent Bitget exploit attributed to DPRK activity.

Investigators compared the attack’s fingerprints with earlier cases. TRM cited small Tornado Cash withdrawals funding an operator wallet, preparation beginning well before the theft, and signatures obtained in advance before being executed together. It also examined the laundering method, including large swaps through market makers and lending protocols.

This attribution is based on combined on-chain and off-chain intelligence, not a single transaction. TRM said preparation lasted at least 36 hours. The attackers’ laundering pattern differed from the bridge-heavy pattern after Bybit, but the shared techniques supported the connection. Chainalysis warned that North Korea increasingly uses sophisticated automation to obscure stolen funds.

A blockchain is a shared record of cryptocurrency transactions maintained across a network. A digital wallet is software or hardware that lets someone manage blockchain addresses; it does not literally store coins. The private key is the secret credential used to authorize transactions. A smart contract is program code deployed on a blockchain that can execute rules, transfers, or other actions.

In the Binance incident, an attacker apparently obtained access to the hot wallet’s signing workflow. The wallet signed an authorization directing a sweeper contract, which then enabled the attacker-controlled transfer. The blockchain recorded those transactions as valid because they carried the required authorization, even though Binance did not approve them.

Confirmed blockchain transactions are difficult to reverse because the network treats valid signatures and recorded history as authoritative. Recovery usually depends on cooperation from exchanges, token issuers, networks, or investigators. Here, Tether, Circle, and Arbitrum could freeze some assets, but Binance still had to trace the rest.