What to know about the $6.3B hack on Binance, likely the biggest-ever crypto theft

Binance is a cryptocurrency exchange, a company that provides a marketplace and related services for digital assets. Exchanges help users trade cryptocurrencies and typically hold or manage wallets containing those assets. Binance matters here because it is described as the world's biggest cryptocurrency exchange, making the reported theft unusually large and widely consequential.

In this incident, hackers moved about $6.36 billion from Binance wallets across ten blockchains, according to blockchain intelligence firm TRM. The company said the attack may have begun with a compromised laptop before investigators found additional points of breach. Binance said it reserved more than $6.34 billion in company funds to cover stolen assets.

The exchange promised to cover all user losses and began recovering assets. It also worked with blockchain partners to freeze roughly $3 billion in affected assets. The incident shows that an exchange can be a central target: one breach may affect many wallets and users at once, even when transactions remain visible on public blockchains.

The suspected Binance theft was enormous: TRM said an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains. TRM and other experts called it the largest cryptocurrency theft on record. Its scale matters because losses of this size can threaten confidence in exchanges and create a major challenge for tracing and recovering digital assets.

The comparison with Bybit makes the difference clear. In February of the previous year, Bybit suffered a $1.5 billion loss in a hack. The FBI attributed that attack to North Korea and TraderTraitor. The Binance figure was therefore more than four times the reported Bybit amount, although Binance founder Changpeng Zhao noted that some earlier attacks had a greater impact measured in bitcoin rather than dollar value.

About half of the Binance assets were frozen, but experts said some unrecovered funds were already being transferred and converted. The final recoverable amount may change as investigators and blockchain firms track the money.

For users, the immediate issue is whether their balances can be restored and whether withdrawals or trading could be disrupted while the investigation continues. Binance said it would cover all losses, which shifts the stated financial burden from users to the company. That promise is important because the reported theft affected assets held through a major exchange.

Binance said it reserved more than $6.34 billion of company funds to cover stolen assets and began recovering assets for users. It also worked with blockchain partners to freeze roughly $3 billion in affected assets. Freezing can stop some funds from moving, but it does not automatically recover money already transferred or converted.

The company is investigating several breach points and sharing regular updates. Its co-CEO Richard Teng said Binance was working nonstop to resolve the incident. Law enforcement is also investigating, while the exchange seeks to identify the criminals and bring them to justice. The company's eventual costs and recovery total remain uncertain in the article.

Blockchain-analysis firms suspect TraderTraitor because the attack resembles earlier operations linked to North Korea. TRM said an attacker moved approximately $6.36 billion across ten blockchains, with most of it moved in about 20 minutes. The speed, scale, and cross-blockchain movement were among the features that raised suspicion.

TRM specifically said several features matched previous North Korea-linked heists and described TraderTraitor as North Korea's elite hacking unit. Chainalysis also believed TraderTraitor likely carried out the attack. The firms reached their conclusions by studying blockchain movements and comparing them with known patterns, rather than simply relying on a public claim of responsibility.

The attribution is still presented as a suspicion, not a final legal finding. Binance said it was working with law enforcement partners to confirm the criminals' identities. President Donald Trump said U.S. officials were investigating and, when asked about North Korea, replied that they were looking at it. No final identification is given in the article.

A wallet-access token is a digital credential that can authorize actions such as signing transactions. If a hacker obtains one with broad permissions, the hacker may be able to direct funds without stealing each user's password individually. This explanation uses established crypto-security knowledge; the article itself only reports a compromised laptop and later-discovered breach points.

A compromised laptop could contain login sessions, signing tools, credentials, or other secrets used by exchange employees. If those secrets let an attacker reach wallet controls, the attacker could send transactions to addresses they control. Broad permissions would make the damage larger, because one credential might authorize transfers from many wallets. The reported movement of billions across ten blockchains illustrates the possible impact.

The exact Binance access path remains unknown. Binance initially said the incident may have involved a compromised laptop, then found additional points of breach. Investigators are still determining what happened, and the article does not confirm a wallet token, its permissions, or the precise sequence used to move the assets.

Crypto transactions are recorded on blockchains, so investigators can often follow funds moving between public addresses. That visibility helped Binance and blockchain firms freeze roughly $3 billion in affected assets. Freezing works when partners or service providers can identify and block assets before they move farther through the system.

The article says some unrecovered assets were already being transferred and converted. Analyst Garrick Hileman compared this to laundering: stolen crypto can be sent through a mixer or tumbler and mixed with other cryptocurrencies, making its path harder to track. Converting assets into other cryptocurrencies can also create more transactions and complicate the investigation, although it does not necessarily erase the original record.

Recovery is therefore uneven. About half of the stolen assets were frozen, while evidence showed the hackers were moving some of the rest. Hileman said it was unclear how long turning those assets into something usable would take. The article notes that some places still allow bitcoin to be converted, creating another route toward spending.

A blockchain is a shared digital ledger that records cryptocurrency transactions. A wallet is software or hardware that manages the credentials for assets, while a private key is the secret that authorizes transfers. Hot storage keeps keys connected to the internet for quick access; cold storage keeps them offline and is generally harder to attack. These explanations use established knowledge beyond the article.

The Binance incident shows both sides of the system. TRM said an attacker moved about $6.36 billion from Binance wallets across ten blockchains, mostly within 20 minutes. Because transfers are recorded, blockchain firms could trace movements and help freeze roughly $3 billion. But if an attacker gains control of signing credentials or systems connected to hot wallets, transfers can happen rapidly.

Cold storage can reduce online exposure, while hot storage supports faster operations. Neither term alone explains the precise Binance breach. Binance said an initial investigation pointed to a compromised laptop and later found more breach points. The article does not specify the wallets' storage arrangements or the private keys involved.