Binance, the world’s biggest crypto exchange, says it was hit by a security breach on Thursday afternoon and has set aside more than $6.3 billion to cover it. If that figure holds, it would be the largest crypto theft on record, roughly four times the $1.5 billion taken from Bybit in February 2025.
According to Binance’s incident notice, the attack may have started with a compromised laptop belonging to a DevOps engineer. That access let the attacker reach an internal service and submit withdrawals Binance did not authorize. The exchange said it found no evidence that wallet private keys leaked. In an update early Friday, it said further investigation had “uncovered additional points of breach,” without giving details.
What Binance has committed to. Binance says it will cover all losses from its SAFU emergency fund and company money, and that user funds are safe. In a post on X Friday morning, it said it has reserved more than $6.34 billion for the incident. About $5 billion of that is already held in the same tokens that were taken, and it is buying the rest through market and over-the-counter channels. Binance also says about $3 billion has been frozen with help from stablecoin issuers and other partners. Tether’s chief executive, Paolo Ardoino, said Tether alone froze more than 1.567 billion USDT.
What customers can do now. Withdrawals are suspended. Binance said Friday it is on track to resume them in about 45 hours. Deposits remain unaffected, the company said, though an earlier Binance post had said both deposits and withdrawals were paused. Binance has promised a technical post-mortem and an updated proof of reserves once the fix is done. Neither has been published yet.
Who is behind it. Chainalysis puts the theft at about $6.4 billion and attributes it to TraderTraitor, a North Korean hacking group. Binance dates the start of the compromise to about 4:05 p.m. ET Thursday. TRM Labs said the attack resembles past North Korea-linked incidents. Binance has not named a culprit.
Market reaction. Bitcoin traded near $77,450 at 8:15 a.m. ET Friday, down about 3% over 24 hours, according to CoinGecko. Ether was near $2,238, down about 3.6%, and Binance’s own BNB token was near $700, down about 5%. U.S. spot bitcoin ETFs took in a net $17.2 million on Thursday, while ether ETFs lost $105.5 million, according to Farside Investors. That trading closed before the breach began.
For cautious holders, the practical points are simple. Binance’s pledge is a company promise, not an insured guarantee, and the proof will come when withdrawals reopen and new reserve data is posted. Use only official Binance channels, since fake “refund” and support accounts often follow incidents like this.
Sources: Binance, Binance on X, Paolo Ardoino on X, Chainalysis, BBC News, CoinGecko, Farside Investors.