Binance, one of the biggest crypto exchanges, has been hit by what is described as the biggest crypto theft in history. Hackers stole at least $6.3 billion from its wallets, and security researchers blame North Korea, according to TechCrunch and Engadget, with Ars Technica and Wired also covering the story.
What Binance says happened. The company’s initial investigation points to a compromised laptop belonging to a DevOps engineer. According to Binance, an attacker used it to reach a service container and submit unauthorized withdrawal transactions. Binance says it has seen no evidence that its private keys leaked. TechCrunch notes it is still unclear how the laptop was compromised, and says Binance did not answer questions on whether a third party had audited its network before the incident.
The scale. TechCrunch puts the loss at at least $6.3 billion, while Engadget describes it as an estimated figure from Binance and The New York Times. If accurate, it would beat the Bybit theft of 2025, which TechCrunch puts at $1.4 billion and Engadget at $1.5 billion, so the reports differ on that earlier figure. The total may still change as the investigation continues.
Who is blamed. Blockchain analytics firm TRM Labs attributed the attack to North Korean hackers and said the theft took about 20 minutes, a detail echoed in Wired’s headline. TRM links it to a group known as TraderTraitor, which was also blamed for the Bybit theft. Elliptic, another analytics firm, also pointed to North Korea, saying some stolen funds went to a wallet used in an earlier attack on the Bitget exchange, in which $351 million was stolen this year. Researchers say these thefts help fund North Korea’s weapons program. These are attributions from private security firms, not a government finding.
What has been frozen. Binance spokesperson Andie Cooper said industry partners had frozen about $3 billion. Engadget reports that stablecoin issuers Tether and Circle froze funds tied to the attack, but its figures for the two do not match the numbers in a post by Binance’s former chief executive, and the article does not reconcile them. Binance says it has begun recovering affected assets and is working with law enforcement, token issuers and blockchain intelligence firms.
What it means for customers. Binance says user funds are safe and that it will cover all losses using its SAFU fund, a reserve set aside for users, along with company funds. TechCrunch says Binance did not immediately provide proof. The company has promised an updated proof of reserves once remediation is complete. Withdrawals are suspended while Binance carries out a security overhaul, and TechCrunch reports deposits are suspended as well, while Engadget describes deposits as normal, so the reports differ on that point.
Why it matters. The reported cause is a single employee’s laptop, and TechCrunch notes that Binance will face questions about how one machine could reach systems that control billions of dollars. The case is a reminder that even very large exchanges can be undone by ordinary endpoint security failures. A market analyst quoted by Engadget said the hack may weaken appetite for risk and push investors to reassess centralized exchanges.
What to watch. Look for Binance’s proof of reserves, any government statement on attribution, how much of the frozen money is returned, and whether regulators in the US and UK ask exchanges about their internal security controls. Readers with funds on any exchange should use strong account security and keep up with official updates.
Sources: TechCrunch and Engadget, with headline details from Ars Technica and Wired. Figures are as reported by Binance, TRM Labs, Elliptic and those outlets. This is not financial advice.
Bitcoin on a laptop keyboard (representative image), Wikimedia Commons, CC BY 2.0
