Hackers steal $6.3bn from cryptocurrency platform Binance

The attack was a massive theft from Binance, the world's largest cryptocurrency exchange. Hackers accessed wallets connected to the exchange and stole about $6.3 billion. Analysts described it as potentially the biggest cryptocurrency hack ever. The incident matters because it exposed risks in a major platform used by hundreds of millions of people.

The attackers targeted Binance wallets on 10 blockchains. TRM Labs said they shifted most of the stolen funds in about 20 minutes. Binance initially suspected a compromised laptop, but later identified several additional points of breach. The attackers used those weaknesses to make unauthorized withdrawals from exchange systems.

Binance said it worked with partners and law enforcement to freeze affected assets. About $3 billion had been located, while the status of the remaining $3.3 billion was unclear in the report. Binance said deposits were unaffected and expected withdrawals to resume within 48 hours.

The reported theft was enormous by cryptocurrency standards. Chainalysis, TRM Labs, and other industry experts said it could be the world's biggest crypto heist. One industry executive called it the biggest hack in history. The size could make the event more damaging than earlier attacks because Binance is a major global exchange.

The stolen amount was about $6.3 billion. Binance said partners had frozen roughly $3 billion of affected assets. Tether froze nearly $1.57 billion, Circle froze more than $800 million, and Ripple froze about $200 million. Binance co-founder Yi He also said $27 million in stablecoins and about $2 million in World Liberty tokens had been frozen.

The article did not give a confirmed recovery figure for every asset. Binance did not explain the status of the remaining $3.3 billion. Its co-founder said the exchange would cover all hacking losses, while Binance said user funds remained safe.

A cryptocurrency exchange is a service that lets users buy, sell, and trade digital assets. Binance is one such platform and is described as the world's largest cryptocurrency exchange. It also holds assets for users, meaning customers can keep digital money within accounts managed through the exchange rather than managing every wallet directly.

Binance's scale explains its large holdings. The exchange had more than 335 million registered users globally. Its annual report listed about $160 billion in assets under custody in 2024, and about $162.8 billion in its 2025 annual report. These figures show how much digital value can be concentrated in one platform.

That concentration makes Binance useful but creates security concerns. A successful attack can affect many wallets and assets at once. Binance said deposits were unaffected, user funds remained safe, and its secure asset fund is intended to protect users during security breaches.

A breach at a major exchange can hurt confidence beyond the stolen assets themselves. The article says investors may reassess whether centralized exchanges can safely hold their digital money. They may also focus more on counterparty, solvency, and liquidity risks. Weaker confidence can reduce demand and risk-taking across cryptocurrency markets.

Markets reacted immediately. Bitcoin dropped more than 3% to $76,368, while Ether fell more than 3% to $2,178. BNB fell 5% to $709.70. Coinbase shares slid 4.8%, and Strategy shares fell nearly 6% in extended US trading. These moves show that the impact reached related companies and major tokens.

The wider crypto market was already under pressure from higher US interest rates and softer demand from exchange-traded-fund buyers. The breach could further dampen risk appetite. One industry executive predicted users would move away from smaller and medium-sized exchanges that could not cover a major hack.

A compromised employee laptop can expose an exchange's internal systems if it gives attackers access to accounts, tools, or connected networks. The article does not describe the precise technical path. It says Binance's initial investigation pointed to an engineer's hacked laptop, which may have been the entry point.

From there, an attacker gained access to one of Binance's systems and made unauthorized withdrawals. Binance later said the incident involved several points of breach and multiple factors. This suggests the laptop was not necessarily the only weakness. Additional compromised systems or credentials may have helped attackers move through the exchange's processes and approve transfers.

Binance said its security team was tracing the full attack path through the compromised computer. The investigation was continuing with law enforcement. Because the article does not identify every weakness or explain the exact authorization process, the complete sequence remains unresolved. Binance said deposits were unaffected and expected withdrawals to resume within 48 hours.

Some crypto assets have an issuer or company with technical control over the tokens. That control can let the issuer block transfers or freeze balances associated with a suspected theft. Tether, Circle, and Ripple demonstrated this ability after the Binance incident. The article reports that each company froze assets linked to the attack.

Tether froze nearly $1.57 billion, Circle froze more than $800 million, and Ripple froze roughly $200 million. Binance's Yi He also said $27 million in stablecoins and about $2 million in World Liberty tokens had been frozen. These actions can prevent certain funds from moving through supported systems, though they do not automatically recover every stolen asset.

Other digital assets may be harder to recover when no central issuer controls transfers. Bitcoin, for example, is described here as the reserve behind Binance's secure asset fund, but the article does not say it can be frozen. In general, investigators can trace such transactions, while stopping or reversing them remains difficult.

A blockchain is a shared digital record of cryptocurrency transactions. When a transfer is accepted, the ledger records the sending address, receiving address, and amount. New transfers are linked to the existing record, allowing participants and analysts to follow how assets move between addresses. The article refers to the attackers targeting wallets on 10 blockchains.

This visibility helps investigators map a theft. Blockchain analysis firms such as TRM Labs and Chainalysis tracked the Binance funds and identified patterns matching earlier North Korean-linked heists. Investigators can watch funds move, identify addresses connected to the attack, and work with companies that control some tokens to freeze them.

Transparency does not automatically undo a completed transfer. A blockchain can show where assets went without giving investigators a universal button to return them. Recovery depends on whether a company can freeze the asset, whether funds reach a cooperative service, or whether authorities can identify and seize them. The article reports tracing and freezing, not transaction reversals.