Binance confirmed that user funds remain safe and pledged to cover all financial losses resulting from the incident through its Secure Asset Fund for Users (SAFU) and company reserves. A spokesperson stated that the company is working around the clock with law enforcement and industry partners to trace affected assets. Initial investigations suggest the attack may have involved a compromised laptop belonging to a DevOps engineer, which potentially allowed an attacker to access a service container and submit unauthorized withdrawal transactions. However, TRM Labs’ on-chain analysis points to a compromise of Binance’s hot wallet signing infrastructure, with preparation for the theft beginning at least 36 hours prior to the event.
TRM Labs detailed that the attacker moved funds across ten blockchains, including Ethereum, Bitcoin, Tron, Solana, and the XRP Ledger. Ethereum accounted for the largest share of the theft at approximately $3.79 billion, followed by Bitcoin outflows totaling $1.47 billion. Tether, Circle, and Ripple have frozen billions in potentially affected tokens, with Tether freezing nearly $1.57 billion and Circle freezing more than $800 million. The attribution to North Korea is based on intelligence linking the group to previous high-profile hacks, including the 2025 Bybit incident and the 2026 KelpDAO hack, noting similar patterns such as the use of Tornado Cash for initial funding.
The scale of the breach triggered immediate volatility in digital asset markets. Following the announcement, Bitcoin fell roughly 2% to a six-week low of $77,646, while Ether dropped approximately 2% to $2,238. BNB, Binance’s native token, declined more than 8% over a 24-hour period. Binance founder Changpeng Zhao, who no longer manages the exchange, described the event as a hack on X, thanking stablecoin issuers for their rapid response in freezing assets. The company plans to publish an updated Proof of Reserves once the incident is fully resolved.
While Binance has not officially characterized the event as a state-sponsored attack, the FBI previously named TraderTraitor as responsible for the $1.5 billion Bybit hack in February 2025. TRM Labs continues to track the remaining unfrozen funds, estimated at roughly $2.4 billion, through its Beacon Network to alert partners and facilitate recovery efforts.
