The scale of the disruption is unprecedented. According to TRM, a US-based blockchain intelligence firm, attackers moved approximately $6.36 billion out of Binance wallets across 10 different blockchains. The velocity of the theft was staggering; TRM reported that most of these funds were drained within a window of about 20 minutes. The firm described the incident as the largest cryptocurrency theft on record, a figure that dwarfs previous high-profile incidents, such as the $1.5 billion hack of the exchange Bybit in February 2025, which the FBI also attributed to North Korea.
The attribution of this attack is not speculative. TRM stated in a report published Thursday that it made its judgment with “high confidence,” linking the breach to TraderTraitor, an elite North Korean hacking unit. Jonathan Levin, co-founder and CEO of blockchain analysis company Chainalysis, concurred, saying the attack was likely carried out by the same group. TRM noted that several features of the Binance attack matched earlier North Korea-linked heists, suggesting a consistent methodology used by the unit. While Binance has not officially confirmed the attribution, stating it is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice,” the technical evidence presented by independent analysts points strongly toward a state-sponsored operation.
Understanding how such a vast sum was extracted requires looking at the specific vulnerabilities exploited. Binance’s initial investigation suggests the attackers did not compromise the core cryptographic keys that secure the exchange’s cold storage. Instead, the breach originated from a compromised laptop belonging to a software infrastructure engineer. This single point of failure granted the attackers access to an internal service, allowing them to submit unauthorized withdrawals. This distinction is critical: it indicates that the perimeter of the exchange’s most secure holdings remained intact, but the internal operational infrastructure was breached. The absence of leaked private keys suggests that while the immediate threat of total fund evaporation was mitigated by the internal service compromise, the lateral movement within the company’s systems was successful enough to facilitate the $6.36 billion exfiltration.
The immediate response involved a coordinated effort to freeze the stolen assets before they could be laundered or moved beyond reach. Binance reported that it had located and frozen approximately $3 billion (€2.7 billion) of the affected assets. The company did not provide information regarding the remaining $3.3 billion, leaving a significant portion of the theft unaccounted for in their initial disclosure. The impact rippled across the broader cryptocurrency ecosystem. Tether, the issuer of the USDT stablecoin, froze around $1.6 billion in its currency, according to CEO Paolo Ardoino. Similarly, Circle, the issuer of USDC, froze approximately $800 million worth of its stablecoin, as announced by boss Jeremy Allaire. These actions underscore the interconnectedness of the crypto market, where a breach at a major exchange triggers defensive measures across multiple protocols to prevent the circulation of illicit funds.
The geopolitical context of this attack is well-documented. Experts note that North Korea utilizes cryptocurrency theft and other illicit cyber activities to obtain foreign currency, a vital resource that helps fund its nuclear program despite international sanctions. The attribution to TraderTraitor places this incident within a broader strategy of state-sponsored cybercrime aimed at generating revenue for military and technological development. This is not an isolated act of criminal greed but a calculated extraction of resources from the global digital economy.
The market reaction to the news was swift and volatile. Bitcoin’s value tumbled by 3.2% on Thursday evening, dropping below the $79,000 mark. This reaction reflects the fragility of confidence in digital asset platforms, where trust is paramount. For users, the suspension of trading meant an inability to move funds, a stark reminder of the operational risks inherent in centralized exchanges. However, Binance leadership has moved to reassure the market. Co-founder Yi He stated that “Binance will cover all hacking losses” and that “user funds are completely safe.” Changpeng Zhao, who founded Binance in 2017 and stepped down as CEO in 2023 after pleading guilty to failing to prevent money laundering, added his voice to the reassurances. Zhao, who was pardoned by US President Donald Trump in 2025, said, “as a shareholder, I expect all user funds will be fully covered.” Zhao and Binance have been noted as key supporters of cryptocurrency ventures associated with the Trump administration.
Despite these assurances, questions remain regarding the remaining $3.3 billion in unlocated assets. The technical explanation of the breach—a compromised engineer’s laptop leading to internal service access—raises ongoing concerns about insider threats and the security of human-operated infrastructure. Even with robust cryptographic safeguards for private keys, the supply chain of human access and internal permissions remains a critical attack surface. The fact that the attack was executed across 10 blockchains within 20 minutes demonstrates the advanced automation and planning behind the operation.
As Binance continues its investigation with law enforcement partners, the focus shifts to the recovery of the unfrozen assets and the identification of the specific individuals within the organization whose credentials were compromised. The incident serves as a stark reminder that in the digital asset space, security is not merely a matter of code, but of operational discipline and the resilience of human systems. The next confirmed development will likely come from forensic reports detailing how the internal service was accessed and whether additional vulnerabilities were exploited during the 20-minute window of the heist. For now, the trading halt remains in place, a temporary pause in a global market that is grappling with the consequences of one of its largest breaches to date.
