The latest:
Assets worth $6.3 billion were drained from Binance, the world’s largest crypto exchange, in what appears to be the biggest breach the industry has recorded. The figure is more than four times the $1.5 billion stolen from Dubai-based Bybit in February 2025, a theft the FBI attributed to North Korea. Bitcoin fell 4.8% below $77,000 as the news spread.
Details:
- The entry point: According to Binance’s preliminary investigation, the intrusion likely ran through a compromised laptop belonging to one of the company’s engineers, allowing unauthorized withdrawals. Binance said it found no evidence that wallet private keys were leaked, and that funds were pulled from several hot wallets used for continuous trading.
- The numbers: Chainalysis valued the stolen assets at about $5.9 billion at the time of the operation. Arkham Intelligence said attacker wallets at one point held more than $5.7 billion, including roughly $1.5 billion in bitcoin, about $900 million in ether, around $1.5 billion in USDT and over $800 million in USDC.
- The attribution: Industry sources suspect North Korea, and researchers and specialized security firms assess that Pyongyang was behind the operation. The previous record theft, from Bybit, was also attributed by the FBI to North Korea. No law enforcement agency has publicly named a perpetrator in the Binance case.
- Market reaction: Bitcoin traded near $77,400 on Friday morning after its 4.8% drop. Ether fell 5.7% to about $2,300, while BNB, the token of the Binance-linked BNB Chain, slid 8% to roughly $715. AAVE lost 11%, and XRP and Solana also fell sharply.
- Reserves hit: CoinDesk reported that about 204,500 ether were stolen, equal to 5.6% of Binance’s ether reserves, leaving customer ether balances backed at roughly 94% until the shortfall is covered. Between 30 and 40 tokens were affected, including bitcoin, ether and the USDT and USDC stablecoins.
- Laundering trail: Arkham said the attacker is moving assets through the decentralized exchange Uniswap and borrowed at least 20,000 wrapped ether, worth close to $44 million, from a lending platform while posting stolen USDT as collateral.
- The freezes: Close to $3 billion has been frozen, including $2.3 billion in stablecoins. Tether chief executive Paolo Ardoino said more than $1.567 billion in USDT was blocked, and Circle’s Jeremy Allaire said over $800 million in USDC was frozen with law enforcement. Ripple froze about $200 million, and World Liberty Financial froze $27 million of its USD1.
- Binance response: The exchange suspended all deposits and withdrawals pending security checks. Co-chief executive Yi He said Binance would cover all losses caused by the breach and that user funds are safe. The company said it is working with law enforcement partners and will publish a full report once the investigation closes.
- Founder’s comment: Changpeng Zhao, who founded Binance, wrote on X that “this looks like a hack of Binance,” adding that as a shareholder he expects all user funds to be fully protected. Zhao resigned as chief executive in 2023, pleaded guilty to violating US anti-money-laundering law and later received a presidential pardon from Donald Trump.
- The cushion: Binance’s emergency fund, known as SAFU, holds close to $1 billion in bitcoin that can absorb part of the losses. Unlike bank deposits, money held on crypto exchanges carries no government insurance.
Between the lines:
The gap between the $6.3 billion disclosed and the roughly $3 billion frozen leaves a multibillion-dollar hole that SAFU’s $1 billion cannot close on its own. With ether customer balances backed at 94% and withdrawals suspended, the test of Binance’s pledge is whether reserves are restored before confidence erodes further.
What’s next
Binance’s next proof-of-reserves report, due 1 November, will show whether the stolen assets were recovered. Also watch the resumption of deposits and withdrawals, the promised investigation report, and any law enforcement naming of suspects.
