The attack vector appears to have been spearheaded by a compromised device rather than a sophisticated exploit of the exchange’s core infrastructure. In a statement posted on X, Binance explained that the initial investigation suggests the incident involved a “compromised DevOps engineer’s laptop.” This breach allowed an attacker to gain unauthorized access to a service container, enabling them to submit unauthorized withdrawal transactions. The hackers targeted wallets across 10 different blockchains and shifted the majority of the funds in roughly 20 minutes, according to TRM Labs.
The stolen assets included approximately $1.5 billion in Bitcoin, a similar amount in the Tether stablecoin (USDT), and slightly under $1 billion each in Ethereum and the USDC stablecoin. While early reports on social media suggested losses ranging from $2 billion to $8 billion, Binance has settled on the $6.3 billion figure as the current estimate, noting that the full scope may take days to determine. In response to the breach, Binance stated that it had worked with partners to freeze affected assets, successfully locating approximately $3 billion so far. The exchange has not provided details on the status of the remaining $3.3 billion. Binance’s co-founder Yi He stated that the company would cover “all hacking losses,” assuring users that deposits were unaffected. Withdrawal services, which were temporarily suspended, are expected to resume within 48 hours.
The attribution to North Korea is based on technical analysis of the attack’s features, which align with previous operations linked to Pyongyang. TRM Labs noted that the specific methods used to move funds after the theft matched earlier heists, leading the firm to make its judgment with “high confidence.” However, as of the latest reports, no definitive proof has been publicly released, and North Korea’s diplomatic missions in Geneva and China did not immediately respond to requests for comment. The lack of a public claim of responsibility by the attackers remains a standard feature of such state-linked cyber operations.
The market reaction to the news was immediate and severe. During Asian trading on Friday, Bitcoin dropped more than 3% to a six-week low of $76,368, while Ether fell over 3% to a two-month low of $2,178. BNB, Binance’s native token, declined by 5% to $709.70. The incident also impacted traditional equities tied to the crypto sector; shares in Coinbase Global slid 4.8%, and those of Strategy, a major Bitcoin buyer, fell nearly 6% in extended U.S. trading. Aravind Srinivasan, head of systematic OTC business at market maker GSR, described the event as “the biggest hack in history,” noting that it could prompt investors to fundamentally rethink the risks associated with holding digital assets on centralized exchanges.
The breach occurs at a sensitive time for the cryptocurrency industry, which has already faced pressure from higher U.S. interest rates and softer demand. Key industry players, including stablecoin issuers Tether and Circle, moved quickly to assist Binance by coordinating asset freezes. This collaborative response highlights the growing interdependence within the crypto ecosystem, where major firms must act collectively to mitigate the systemic risk posed by large-scale thefts. While the financial loss will be absorbed by Binance, the reputational damage and the demonstration of vulnerabilities in developer access controls pose significant challenges for the sector’s long-term credibility with institutional investors and regulators.
