In this article
The Binance crypto hack stole about $6.3 billion in cryptocurrency during a Thursday evening attack, likely making it the largest crypto theft on record. Binance said the breach began with a compromised laptop belonging to one of its engineers. Blockchain investigators said the attackers then moved most of the assets across several networks in roughly 20 minutes.
Key Takeaways
- Binance said hackers stole about $6.3 billion after compromising an engineer's laptop and systems used to authorize withdrawals.
- About $3 billion was frozen by Tether, Circle, Ripple, World Liberty Financial, Arbitrum and other participants.
- TRM Labs and Chainalysis attributed the attack to North Korea's suspected TraderTraitor group, but the attribution is not officially confirmed.
The attackers reached systems capable of authorizing withdrawals, rather than simply taking funds from an individual wallet. About $3 billion was later frozen by other companies, but more than $2.4 billion in Bitcoin and Ethereum remained with the attackers after they exchanged stablecoins and borrowed against other stolen assets. The full account is detailed in The Record’s report on the Binance crypto hack.
How the Binance crypto hack unfolded
Binance’s postmortem attributed the initial compromise to an engineer’s laptop. According to the exchange, the device gave the attacker access to internal systems that enabled unauthorized withdrawal transactions. The source does not identify a specific software vulnerability or explain precisely how the laptop was compromised.
During the Binance crypto hack, once the attackers could initiate withdrawals, they moved funds through multiple blockchain networks. Most of the stolen assets were transferred in a burst lasting approximately 20 minutes, leaving platforms and investigators little time to identify and block transactions before the money moved again.
The stolen portfolio also changed form. The attackers quickly sold some stablecoins and took out loans against other stolen funds. That reduced the amount participating platforms could freeze and left more than $2.4 billion in Bitcoin and Ethereum, according to the report.
Why some stolen assets could be frozen
In the Binance crypto hack, about $3 billion was frozen after the attackers tried to route the funds through other crypto platforms. Tether, Circle, Ripple, World Liberty Financial and Arbitrum joined efforts to identify and restrict assets connected to the theft.
The response highlights a difference between types of crypto assets. Stablecoins issued or managed by identifiable companies can be restricted by those companies when the assets pass through systems they control. The source does not say that Binance or its partners could exercise the same direct control over Bitcoin or Ethereum, helping explain why those assets remained a central recovery challenge.
Timing and location matter, too. A stolen token may be blockable while it remains with an issuer or participating platform, but that opportunity can narrow after the asset is exchanged, used as loan collateral or transferred to another network. The Binance crypto hack showed how quickly that window can close.
Newsletter
Get the VaidikX AI Brief
The week's biggest AI, Big Tech and startup news, explained in 5 minutes. Free, every week.
Why investigators suspect TraderTraitor
TRM Labs and Chainalysis both linked the Binance crypto hack to TraderTraitor, a hacking group associated by investigators with North Korea. That attribution remains an assessment, not an officially confirmed finding about the government’s role in this specific incident.
Chainalysis said it had a “high degree of confidence” that North Korea was responsible. The company also reported that funds from the Binance attack were commingled in wallets with cryptocurrency stolen from Bitget. Bitget said the previous month that North Korean hackers had taken more than $387 million in a cyberattack.
TRM Labs reached the same broad conclusion using what it described as on-chain and off-chain intelligence. The firm said the operation resembled earlier North Korea-linked thefts, including small Tornado Cash withdrawals used to fund an operator wallet, preparations that began before the main theft, and transaction signatures obtained in advance and executed together. TRM Labs said preparations began 36 hours before the attack.
Investigators have connected TraderTraitor to several earlier incidents. The FBI said the group was responsible for the $1.4 billion theft from Dubai-based crypto platform Bybit last year and nearly $300 million stolen from KelpDAO in April 2026. The FBI has also previously attributed the $100 million Harmony Horizon bridge hack and the $600 million Ronin Bridge hack to the group.
Why the Binance crypto hack matters for US readers
For US users, the immediate questions are whether customer balances will be restored and whether exchange services will remain available. Binance said user funds were safe, pledged to cover all hacking losses with company money and temporarily suspended deposits and withdrawals while it conducted security checks and worked with law enforcement and blockchain security firms.
Binance co-founder Yi He said the withdrawal suspension would last 48 hours. That statement is a company assurance, not an independently verified accounting of every affected asset or a completed recovery. The source also does not report whether US customers experienced losses, how individual accounts were affected or when all services returned.
The incident also matters to businesses that depend on crypto exchanges, stablecoin issuers and blockchain infrastructure. A single compromise at an exchange can require rapid coordination across competing companies and networks. It can also produce uneven recovery prospects because some assets can be frozen while others cannot.
What the theft says about exchange security
The Binance crypto hack puts signing and withdrawal systems at the center of the security discussion. A transaction signature is the authorization that allows a blockchain transaction to be accepted. In this case, Binance said the attackers gained access to systems capable of producing unauthorized withdrawal transactions. That does not establish that the underlying blockchain networks were hacked. Access control is a growing concern across tech, too: Apple, for example, plans clearer warnings around Mac AI agent data access.
The Binance crypto hack also shows why post-incident response cannot rely only on reversing transactions. Blockchain transfers generally move through addresses and networks outside one company’s control. Recovery therefore depends on identifying the assets, persuading issuers or platforms to restrict them where possible, and tracing what happens after exchanges, loans and cross-chain movements.
North Korea’s suspected role adds a broader financial-security concern. United Nations investigators said the country brought in $3 billion from crypto attacks between 2017 and 2023 and stole more than $2 billion in similar attacks last year. Microsoft separately reported that North Korean hackers have used artificial intelligence to create front companies, tailor phishing lures and support operations targeting crypto and financial organizations, among other sectors.
The theft leaves a practical lesson for exchanges: protecting the systems that authorize withdrawals is as important as securing the wallets that hold assets. Binance’s promise to make customers whole addresses the exchange’s stated financial responsibility, but the frozen funds and remaining Bitcoin and Ethereum show how quickly recovery becomes harder once stolen assets move beyond a company’s direct control.
Source: The Record
For more breach and privacy stories, follow our cybersecurity coverage and business and startups reporting.
Additional source: TRM Labs
More from VaidikX
