Hackers Stole $6.3 Billion From Binance in Record Crypto Heist

Hackers stole $6.3 billion from Binance, the world's largest cryptocurrency exchange, in what blockchain intelligence firm TRM Labs calls the largest crypto theft on record. The attack, disclosed by Binance on X on Friday, appears to have started with a single engineer's laptop. The compromised device, the exchange said, "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."

The scale is unmatched. TRM Labs ties the operation to TraderTraitor, which it describes as "North Korea's elite hacking unit." The haul surpasses last year's $1.5 billion Bybit heist, itself a record at the time. In one incident, the attackers took more than four times the previous benchmark.

How did the breach work?

The mechanism matters more than the headline number. Binance's own account points to a supply-chain-style entry: one employee device, then lateral movement into a service container, then forged withdrawal transactions pushed through the exchange's own infrastructure. The attacker did not break the blockchain. They broke the plumbing around it.

That distinction shapes the response. Binance has suspended withdrawals and deposits temporarily. It is also working with blockchain partners to freeze impacted assets before they move beyond recovery.

"Our teams are working around the clock to resolve this issue safely and thoroughly," Binance said in its post on X. "We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice."

Can Binance actually cover $6.3 billion?

Binance says yes. The company claims it will cover all losses through its Secure Asset Fund for Users, known as SAFU. The arithmetic is the problem.

The SAFU fund holds about $1 billion in Bitcoin, according to an expert who voiced doubts to CNBC about a full reimbursement. That is roughly one-sixth of the stolen amount. Unless the freeze on assets succeeds in recovering a large share of the $6.3 billion, the gap between the promise and the pool is more than $5 billion.

Binance's balance sheet gives some context for its confidence. In 2025, the exchange reported $34 trillion in trading volume and more than 300 million users. It held $162.8 billion in assets, according to its own figures. A $6.3 billion loss equals just under 4% of that holdings base — painful, but survivable for a firm of that size. Whether that logic holds until every user is made whole is the open question.

What does the hack mean for Binance's scale?

The numbers explain both the damage and the resilience. An exchange processing $34 trillion in annual volume has deep reserves. It also has a target on its back. TRM Labs' attribution to TraderTrait suggests a state-backed actor with patience, funding and a track record — the same ecosystem behind the $1.5 billion Bybit theft last year. For exchanges, the lesson is that custody of hundreds of billions makes endpoint security on a single laptop a systemic risk.

How did markets react?

Prices fell across the board on Friday morning.

• Bitcoin dropped nearly 4% to $77,594, its lowest level in more than a month.
• Circle Internet Group (NYSE: CRCL), Robinhood Markets (Nasdaq: HOOD) and Strategy Inc. (Nasdaq: MSTR) each fell over 6% in premarket trading.
• Strive (Nasdaq: ASST), a Bitcoin treasury company, and Bitmine (NYSE: BMNR), an Ethereum treasury company, slid more than 4%.

The selloff reached well beyond Binance itself. Treasury companies that hold crypto as their core asset, and platforms that route retail money into it, took the hardest hits. Traders priced the hack as an industry event, not a single-company one.

What happens next turns on two things Binance does not fully control: how much of the $6.3 billion its partners manage to freeze, and how quickly law enforcement can trace assets tied to a unit TRM Labs describes as North Korea's elite. If recoveries fall short and the $1 billion SAFU fund is all that stands between users and their losses, the largest theft in crypto history could become the industry's largest reimbursement dispute.