Crypto giant Binance hit by $6.3bn hack suspected to be largest in history

Binance is a cryptocurrency exchange, meaning a platform where people trade digital assets. The company, founded in China in 2017, is estimated to have more than 300 million registered users. A hack against such a platform matters because it can expose enormous pools of customer assets and damage confidence in crypto trading.

In this incident, Binance said $6.3bn of digital assets were impacted. Its initial checks pointed to a compromised engineer’s laptop and unauthorized withdrawals through a service container. The company later found additional breach points. It said no evidence had been found of a wallet private-key leak, showing that attackers may reach valuable assets through connected systems and authorized processes.

Binance said it would cover all losses and had frozen about half the affected assets. Withdrawals were disabled while the company checked its environment. The incident could bring further investigations, regulatory scrutiny, and pressure on exchanges to strengthen controls around employees, systems, and withdrawal authority.

The reported scale is extraordinary: Binance said $6.3bn of digital assets had been impacted. About half had been frozen, while much remained with the hackers. Check Point called it the largest crypto theft on record, although the investigation was still developing and Binance had not yet detailed every breach point.

The figure eclipses the $1.5bn hack on the Bybit exchange in 2025. It is also a substantial share of Binance’s reported holdings. The company said in 2024 that it had more than $160bn in assets under custody. That comparison shows the incident affected assets worth several percent of the funds Binance held for customers, even though it was not the entirety of those holdings.

The final recoverable amount remained uncertain. Tether and Circle froze about $2.4bn of assets, and other partners froze funds too. The attacker still held an enormous sum, so tracing and recovery efforts were continuing. Binance said it would cover all losses.

The reported method shows why a crypto hack does not necessarily require stealing a wallet’s private key. Binance co-CEO Richard Teng said an attacker first gained access through a compromised engineer’s laptop. That access led to a service container, where unauthorized withdrawal transactions were submitted.

A service container is a software environment used to run a particular application or process. In this case, investigators said the attacker used access to that environment to trigger withdrawals. Teng stressed that the incident was not simply one engineer’s permissions or a single click. It involved a more complex attack process, and Binance said it had not attributed responsibility to any individual.

The investigation later uncovered additional breach points. Binance said there was no evidence of a wallet private-key leak, but that did not prevent unauthorized transactions. Withdrawals were disabled until the environment was considered secure. A detailed post-mortem was promised after the investigation, so the full chain of events remained under review.

TraderTraitor is the name two analytics firms used for a suspected North Korean hacking unit. Check Point said the unit is also known in the industry as the Lazarus Group. North Korea-linked operatives have focused on cryptocurrency companies for years, targeting large stores of digital tokens.

The suspicion rests on several signals rather than a public confession. Chainalysis said it had high confidence that the North Korean group was linked to the hack. TRM Labs reported that multiple features of the Binance incident resembled earlier North Korean-linked attacks, including the 2025 Bybit hack. Check Point also said the Binance attack resembled the September Bitget hack.

The attribution was not presented as final by Binance. The exchange said it was working with law-enforcement partners to confirm the criminals’ identities and bring them to justice. Western security agencies have previously said stolen funds are used to finance North Korea’s nuclear weapons and missile programs. North Korea has denied involvement in past hacks.

Some stolen crypto can be frozen when it is held in assets or systems whose issuers can block transfers. Tether and Circle, two major crypto platforms, said they froze about $2.4bn in response to the potential Binance hack. World Liberty Financial also said it worked with partners to freeze stolen funds.

Freezing does not mean every stolen asset is under one company’s control. Digital assets can move across different wallets and platforms. The article reports that about half of the affected Binance assets had been frozen, while many remained with the hackers. That difference reflects the limits of issuer intervention and the importance of where stolen tokens travel.

Recovery was therefore far from complete. TRM Labs said the attacker still held an enormous sum, and efforts to trace and recover funds would continue. Binance was working with law-enforcement partners. Other exchanges were urged to remain vigilant because their large asset holdings make them attractive targets.

The hack could affect users directly through temporary withdrawal restrictions, uncertainty about asset access, and concerns about losses. Binance disabled withdrawals while it checked whether its environment was secure. The company said it would cover all losses, but recovery efforts were still continuing because the attacker held a large amount of assets.

Markets also reacted quickly. Bitcoin dropped by more than 4% after alerts about the security issue, while Ethereum and Solana also fell. Security experts said the attack resembled the Bitget incident, where $388m was lost. Check Point’s Jayant Dave said attackers may no longer need vault keys if they can target systems and people authorized to use them.

The broader lesson is likely to affect industry practice. Exchanges may strengthen employee-device security, access controls, withdrawal monitoring, and separation of duties. Binance said its investigation found additional breach points and promised a post-mortem. Regulators and platforms may also increase scrutiny, especially because exchanges hold very large pools of digital assets.

A blockchain is a shared record of digital-asset transactions. A crypto wallet is the software or system used to hold access to those assets and send transactions. The private key is a secret credential that authorizes spending. Whoever controls the required key or an authorized connected system can direct assets, so protecting access is essential.

Transactions usually leave a record on the blockchain, allowing analysts to follow transfers between wallet addresses. That helps firms such as Chainalysis and TRM Labs investigate stolen funds. In the Binance case, investigators could trace and assess assets, while Tether and Circle froze some holdings. Binance nevertheless said it had found no evidence of a private-key leak.

Traceability does not guarantee retrieval. Funds may remain in wallets controlled by attackers or move across platforms with different controls. Some issuers can freeze assets, but others cannot. The article says about half the affected assets were frozen and many remained with hackers, illustrating why digital assets can be visible on a ledger yet difficult to recover.