DUBAI — Binance, the world's premier cryptocurrency exchange, has suffered a massive cyberattack resulting in the unauthorized transfer of approximately $6.3 billion (£4.7 billion) in digital assets.
The incident is widely considered the largest cryptocurrency theft recorded in history, eclipsing the previous $1.5 billion exploit targeting Bybit in early 2025.
Method of Compromise
According to an official statement issued by Binance co-CEO Richard Teng, preliminary internal findings indicate that the breach originated from a compromised laptop belonging to a DevOps engineer.
The attacker used the elevated access to reach internal service containers and authorize fraudulent withdrawal requests across multiple blockchain networks.
"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," Teng clarified, emphasizing that no wallet private keys were compromised during the incident.
Breakdown of Asset Recovery and Current Status
Metric | Details / Figures |
|---|---|
Total Impacted Assets | ~$6.3 Billion USD |
Frozen Funds | ~$2.7–$3.0 Billion USD (Coordinated on-chain freezes with Tether, Circle, and ecosystem partners) |
Unrecovered Funds | ~$3.1–$3.6 Billion USD (Converted to BTC/ETH or distributed) |
User Loss Policy | 100% Covered via the Secure Asset Fund for Users (SAFU) and internal treasury reserves |
Platform Status | Deposits active; crypto withdrawals temporarily paused pending security audits |
Attribution Pointing to North Korea
Blockchain analytics platforms, including TRM Labs and Chainalysis, have reported high-confidence links connecting the heist to TraderTraitor, a notorious cyber-warfare unit sponsored by the North Korean government.
Execution Pattern: Security researchers noted that the sophisticated multi-chain withdrawal techniques mirror tactics employed during the 2025 Bybit heist.
On-Chain Behavior: The attackers rapidly moved assets through automated liquidity routing to convert stablecoins into unfreezable Bitcoin and Ethereum holdings.
Binance has declined to comment directly on specific state-actor allegations, stating that it continues to work directly with international law enforcement agencies to identify the perpetrators and recover the stolen assets.
