Binance Hack Explained: How $6.3B Was Stolen
Binance says a security breach affected $6.3 billion in assets. Here is how the hack unfolded, what has been frozen, and why analysts link it to North Korea.
Binance, the world’s largest cryptocurrency exchange, says a security incident affected about $6.3 billion in assets. If confirmed in full, it would be the largest crypto theft on record, and within days nearly $3 billion had been frozen on-chain.
What Binance says happened
Binance said the incident may have started with a compromised laptop belonging to a DevOps engineer. That gave an attacker access to a service container, which was then used to submit unauthorized withdrawal transactions. In its initial update, the company said there was no evidence that wallet private keys had leaked.
Later, Binance said its investigation had found additional points of breach beyond that laptop. It also said it was working with law enforcement and blockchain intelligence firms to trace the funds.
How the money moved
Blockchain analysts describe a fast operation that was prepared in advance. According to TRM Labs, the attacker took control of a Binance hot wallet and sent its balance to an address the attacker controlled in one transaction. TRM estimated that about $6.36 billion left Binance wallets across ten blockchains, most of it within roughly 20 minutes.
TRM also said the preparation started at least 36 hours before the theft. The attacker reportedly funded an operator wallet through small Tornado Cash withdrawals and tested the attack code on other wallets beforehand. These details come from analysts, not from a full root-cause report by Binance, which has not yet been published.
How much was lost, and why the numbers differ
Binance’s figure is about $6.3 billion. Chainalysis estimated about $5.9 billion at the time of the theft. Elliptic put the total at $6.43 billion.
The differences come from timing, since crypto prices move quickly, and from which assets each firm counts. When you quote a number, name the source and the date.
What has been frozen
Stablecoin issuers moved quickly. Tether and Circle froze large amounts of USDT and USDC linked to the incident, and Ripple and World Liberty Financial also froze funds. The Arbitrum Security Council froze a smaller amount of ETH and ARB.
Binance said about $3 billion had been traced and frozen. Elliptic reported a lower figure of about $2.84 billion, since the totals were still changing.
Not all of the money can be frozen. Native assets like ETH and BTC have no central issuer that can block them. The Hacker News reported that the attacker still controlled more than 420,000 ETH and 18,270 BTC, worth roughly $2.4 billion at the time.
Who is behind it?
TRM Labs has attributed the attack, with high confidence, to TraderTraitor, a North Korea-linked group that it also connects to the 2025 Bybit theft.
Chainalysis also reports a high degree of confidence in a North Korea link, pointing to stolen funds that were commingled with proceeds from a separate exploit.
Elliptic is more cautious. Its analysts note that the laundering speed and methods differ from earlier North Korea-linked heists. Until an official investigation or Binance’s root-cause report is published, “North Korea” should be described as the leading attribution from analysts, not a confirmed finding.
What it means for users
Binance said user funds are safe and that it will cover losses through its Secure Asset Fund for Users (SAFU) and its own reserves. The company paused deposits and withdrawals while it revamped the withdrawal service and checked affected systems.
If you use Binance, check its official channels for withdrawal status. Be wary of messages offering refunds, recovery help, or account “verification,” because scammers often target people after large hacks.
