Binance announced that it was hit by a cyberattack that allegedly drained cryptocurrencies with an estimated total value of around $6.3 billion. If the figure is confirmed, it would be the largest theft ever recorded in the crypto sector, more than four times larger than the $1.5 billion attack that affected Bybit in 2025.
The exchange maintains that user balances will be fully protected and that losses will be covered using its own resources and the SAFU fund, the emergency reserve established by Binance to handle situations of this kind. In the meantime, it has suspended withdrawals to upgrade defenses and contain the incident, while deposits remain operational according to updates released by the company.
Therefore, at least in the company's initial reconstruction, this is not an issue confined to a single blockchain or a single token. The case involves the infrastructure of a central market player: for this very reason, its impact extends beyond the nominal value of the stolen coins. Binance custodies assets for millions of customers and plays an essential role in the ecosystem's liquidity flows. A halt in withdrawals, even temporary, tests confidence in the centralized exchange model.
What Binance discovered
Initial information released by the company pointed to the potential compromise of a DevOps engineer's laptop. From that access point, the attacker allegedly reached a service container and submitted unauthorized withdrawal transactions. It is an important detail, but it does not describe the full intrusion chain.
In subsequent communications, Binance clarified that the investigation identified additional points of compromise. Co-CEO Richard Teng ruled out that the operation could be explained as the direct use of a single employee's permissions or as an isolated single-step action. The company also stated that it has not assigned individual responsibility and has found no evidence so far of a leak of wallet private keys.
The distinction is technically significant. The theft of a private key would entail direct control of a blockchain address; an abuse of the internal operational chain, on the other hand, can exploit systems, permissions, and procedures an exchange uses to authorize customer transactions. In either case, the damage can be immense, but the necessary countermeasures are not the same. Revoking the authorization of the affected address was one of the actions already taken by Binance.
Three billion frozen, but recovery remains partial
The public nature of blockchains makes it possible to trace many transfers, though not necessarily recover them. Binance stated that approximately $3 billion of the affected assets have been frozen on-chain so far through collaboration with industry partners. Stablecoins issued by centralized entities provide an additional tool in certain circumstances: Tether and Circle indicated they had frozen approximately $1.5 billion and $800 million linked to the attack, respectively.
Freezing assets is not equivalent to automatically restoring them to their original balances, nor does it cover the entire estimated amount. It depends on the type of tokens, the speed at which they were moved, and the ability to identify the addresses used by the attackers before the funds pass through conversions, bridges, or other services. However, it is an element that can limit the practically spendable value of the stolen assets and provide investigators with an operational trail.
For the portion not yet frozen, Binance claims to have coverage exceeding $6.34 billion between corporate funds and SAFU. According to the company, $5 billion is already held in the same digital assets involved in the incident; the emergency fund, at the latest valuation cited by the firm, was worth approximately $1.3 billion. It is a reimbursement pledge that mitigates the immediate risk for users, but one that will need to be verified as services reopen and claims are actively processed.
- Estimated theft reported by Binance: approximately $6.3 billion.
- Assets already frozen: approximately $3 billion, according to the exchange.
- Withdrawals suspended during the security response; deposits reported as functioning normally.
The TraderTraitor hypothesis and the North Korean precedent
Binance has not publicly named a culprit. However, blockchain analytics firms TRM Labs and Chainalysis attribute the operation to TraderTraitor, a cybercrime group linked to North Korea and already known for attacks targeting crypto platforms. TRM Labs refers to a high-confidence assessment based on evidence gathered both on and off-chain.
Attribution in the cyber domain must nonetheless be treated with caution: the investigation remains ongoing and does not amount to a judicial indictment or formal confirmation from authorities. The context, however, is consistent with a now well-documented pattern. Over the years, groups linked to Pyongyang have targeted exchanges, wallets, developers, service providers, and employees with technical privileges, using targeted intrusions and social engineering to access digital funds that can be rapidly transferred across borders.
The potential involvement of TraderTraitor shifts the focus from a single bug or human error to the overall resilience of the operational supply chain. A compromised laptop may serve as the initial point of entry, but an attack capable of generating billions in withdrawals raises questions about network segmentation, privileged access management, multi-tiered transaction controls, and real-time anomaly detection capabilities.
The problem of centralized custody
For cryptocurrency users, the Binance case reopens an issue the industry has debated for years: entrusting assets to a platform simplifies buying, selling, and conversions, but exposes them to the risk of a single infrastructure becoming an exceptionally high-value target. Centralized exchanges concentrate funds, authorization processes, and operational responsibilities. They are therefore more convenient for the average user than self-custody, but they must guarantee standards of security, liquidity, and transparency commensurate with their scale.
The incident also highlights the two-sided nature of stablecoins. On one hand, the ability of issuers to freeze addresses allows a portion of stolen funds to be halted quickly. On the other hand, it demonstrates the extent to which certain components of the crypto market depend on entities capable of centralized intervention. It is a trade-off that can prove decisive in curbing criminal activity, but one that remains far removed from the concept of fully censorship-resistant assets.
Upcoming assessments will address the actual extent of the compromise, the trail of unblocked funds, and the timeline for returning to full operations. Binance will also have to clarify what changes it will introduce to its security architecture, without disclosing details that could facilitate further attacks. For the market, the test will be seeing whether the promised reimbursement and the resumption of withdrawals take place without further tension. After a theft of this scale, simply stating that funds are safe will not be enough: operational evidence, verifiable over time, will be needed.
