Binance hit by $6.3 billion hack in record crypto theft

Binance promises to cover losses

Binance said it had worked with partners to freeze approximately $3 billion. It pledged to cover losses using its customer-protection reserve, known as SAFU, and company resources.

Freezing funds can stop their onward movement without immediately returning them to the exchange. Elliptic found that almost all of the assets frozen in its analysis were stablecoins, whose issuers can restrict transfers. It reported no such freeze on the stolen bitcoin, which has no central issuer able to perform that action.

The distinction matters for customers waiting for access to their assets: a company commitment to replace funds, a restriction placed on stolen tokens and the recovery of those tokens are separate steps.

The investigation has widened

Binance’s initial account pointed to the possible compromise of a laptop used by a DevOps engineer. The company said that access may have allowed an attacker to reach an internal service and submit unauthorized withdrawals. It said investigators had found no evidence of a wallet private-key leak.

A later company update said investigators had identified additional entry points. Binance described a complex attack and said it was still establishing the facts with law enforcement. The finding means the laptop explanation is preliminary, not a complete account of how the theft was carried out.

In that update, Binance said deposits remained unaffected and withdrawals were paused. It said the suspicious outflows stopped when withdrawal services were suspended. A full technical report is expected after the investigation is complete.

Researchers point to North Korean hackers

TRM attributed the attack to TraderTraitor, a North Korean hacking group, with high confidence. Its assessment drew on blockchain activity and information gathered outside the blockchain. Elliptic separately said the evidence pointed toward North Korea-linked actors.

Those are investigators’ assessments. Binance’s notices reviewed for this report said it was working with law enforcement to establish the attackers’ identity; they did not announce a final attribution.

The scale surpasses the approximately $1.5 billion stolen from Bybit in February 2025. The FBI attributed that earlier theft to North Korea and described the operation as TraderTraitor activity. In its public alert, the agency said stolen assets were being converted and distributed across thousands of blockchain addresses.

For Binance, the unresolved questions include how the attackers gained access, how much can be recovered and when affected withdrawal services will be restored. The company’s coverage pledge and efforts to retrieve stolen funds remain separate processes.