- Blockchain intelligence firm TRM Labs estimates that around $6.36bn (£4.7bn) was moved from Binance wallets
- The suspected North Korean hacking unit TraderTraitor has been linked to the attack
- Around $2.7bn in assets has been frozen, while Binance has pledged to cover customer losses
The world's largest cryptocurrency exchange, Binance, is facing the fallout from a reported $6.36bn (£4.7bn) security breach, in what could become the biggest cryptocurrency theft on record.
Blockchain intelligence firm TRM Labs said an attacker moved digital assets worth approximately $6.36bn from Binance wallets across 10 blockchain networks on Thursday (29). Most of the transfers took place within around 20 minutes.
The firm attributed the attack with high confidence to TraderTraitor, an elite North Korean hacking unit linked to previous major cryptocurrency thefts.
The suspected breach has raised questions about the security of centralised cryptocurrency platforms, particularly as exchanges increasingly handle large volumes of digital assets across multiple networks.
Binance said its teams were working urgently to establish what happened. Its co-chief executive Richard Teng said the initial investigation suggested the incident may have started with a compromised laptop belonging to a DevOps engineer.
However, he cautioned against treating the incident as a simple case of one employee's permissions being exploited.
"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process," Teng said.
He added that the investigation had not attributed responsibility to any individual and that the company was working with law enforcement.
How much of the stolen cryptocurrency has been recovered?
Binance said it had worked with industry partners to freeze affected assets, with around $3bn identified so far. TRM Labs put the wider value of assets frozen by stablecoin issuers and other networks at approximately $2.7bn.
The attacker is still believed to control assets worth around $2.4bn, including substantial holdings of Bitcoin and Ether. Unlike stablecoins, which can be frozen by their issuers, Bitcoin does not have a central authority capable of blocking transactions.
Binance has pledged to cover the losses and insisted that customer funds remain safe.
"Rest assured that user funds are completely safe," a company spokesperson said.
Co-founder Yi He also said Binance would cover all hacking losses. The exchange temporarily suspended deposits and withdrawals on affected networks while it investigated the incident and strengthened security measures.
The suspected attack appears to have involved extensive preparation. TRM Labs said activity linked to the attacker began at least 36 hours before the main transfers, suggesting the operation was planned rather than opportunistic.
The firm also identified similarities with previous attacks attributed to North Korean hackers, including the $1.5bn theft from cryptocurrency exchange Bybit in February 2025. That incident had previously been regarded as the largest cryptocurrency theft on record.
What does the Binance hack mean for the crypto industry?
The incident is particularly significant because of Binance's position in the global cryptocurrency market. The exchange says it serves more than 335 million users worldwide and remains one of the industry's most influential trading platforms.
A breach on this scale could put pressure on other exchanges to review their wallet security, employee access controls and transaction approval systems. It also raises questions about how quickly stolen assets can be traced and frozen when they move across multiple blockchain networks.
Ari Redbord, chief policy officer at TRM Labs, described the incident as extraordinary in both its scale and the speed of the response.
He said the attacker had been able to move billions of dollars across eight blockchain networks in approximately 15 minutes.
Izabella Kaminska, editor of independent publication The Blind Spot, said the incident exposed the extent to which major cryptocurrency platforms remain centralised despite the industry's emphasis on decentralisation.
She warned that unlike conventional banks, cryptocurrency platforms do not have access to a lender of last resort or a deposit insurance fund if they are hacked or become insolvent.
The breach also comes against the backdrop of Binance's earlier regulatory troubles. In November 2023, the company pleaded guilty to anti-money laundering and sanctions violations in the US and agreed to a $4.3bn settlement with the US Department of Justice. Founder Changpeng Zhao stepped down as chief executive and was sentenced to four months in prison.
Although Binance has continued to expand since that episode, the latest incident puts its security infrastructure under renewed scrutiny.
The wider concern is whether a breach at a major exchange could undermine confidence in the digital asset market at a time when cryptocurrency businesses are becoming more closely connected to conventional financial institutions.
The full extent of the damage, the precise method used to gain access and the amount of cryptocurrency that can ultimately be recovered remain under investigation. For now, Binance's promise to cover customer losses may help reassure users, but the incident is likely to intensify scrutiny of security standards across the industry.
