Binance hit by $6.3 billion hack: Withdrawals suspended in what could be the largest crypto theft in history

Binance, the world’s largest cryptocurrency exchange, was hit by a cyberattack that stole $6.3 billion. Analysts described it as the biggest hack in the sector’s history, an episode that could prompt investors to rethink the risks of owning digital assets.

According to Binance’s statement, an attacker sent unauthorized withdrawal transactions after gaining access to a system on the platform. The company said it would absorb the cost of the incident through its SAFU reserve fund and its own funds, and that it found no evidence that private wallet keys were leaked.

As immediate measures, Binance temporarily suspended deposits and withdrawals while it completes security checks, revoked the authorization of the affected address and called in law enforcement and blockchain intelligence partners to track down and recover the funds.

Deposits, or funds sent into the platform, are operating normally, according to co-founder Yi He. Withdrawals, by contrast, remain temporarily suspended, and Binance expects to begin restoring them within the next 48 hours.

According to U.S. blockchain analysis firms TRM Labs and Chainalysis, the perpetrators came from North Korea. The attackers targeted Binance wallets on 10 blockchains and moved most of the funds in about 20 minutes, according to a TRM statement.

TRM said several features of the attack matched previous North Korea-linked thefts, including the 2025 hack of the Bybit platform, which the FBI had attributed to Pyongyang. “We make this assessment with a high degree of confidence,” the firm said.

What Binance said

The company said it worked with partners to freeze the affected assets and that, so far, about $3 billion has been located. It did not say what happened to the remaining $3.3 billion.

Its co-founder, Yi He, said the platform will cover “all losses from the attack”.

In a statement posted on its X account, Binance detailed the possible source of the breach: “Binance’s initial investigation suggests the security incident may have involved a compromised DevOps engineer’s laptop, allowing an attacker to access a services container and send unauthorized withdrawal transactions”.

“We found no evidence of any leakage of private wallet keys. We will share a detailed technical report once the investigation is complete and the facts have been fully verified,” the company added.

In another statement, Binance said: “The incident is due to multiple factors. Our security team is tracing the attack’s full path through the compromised computer, which may be the incident’s entry point”.

On the losses, the statement said: “Binance will cover all losses with the SAFU fund and company funds. User funds are safe.” The platform also pledged to publish an updated proof of reserves once remediation is complete.

The SAFU is a secure asset fund for users, made up of a reserve held entirely in bitcoin and intended to protect assets in the event of security breaches, according to the company’s website.

“Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice,” the company said, urging users to rely only on its official channels for updates.

Binance also said its deposits were not affected and that it expects to resume withdrawals within the next 48 hours. “User funds remain safe,” it said.

Frozen assets

Several companies in the industry helped freeze the funds. Stablecoin issuer Tether said it froze nearly $1.57 billion linked to the incident, while Circle immobilized more than $800 million.

World Liberty Financial, a cryptocurrency company tied to U.S. President Donald Trump and his family, said Thursday that it worked with custodian BitGo to freeze the stolen funds.

According to Yi He, $27 million in stablecoins and about $2 million in World Liberty tokens were immobilized. Ripple also froze about $200 million, Yi He said.

Market reaction

Markets reacted immediately during Friday’s Asian session. Bitcoin fell more than 3% to a six-week low of $76,368, and ether slipped more than 3% to a two-month low of $2,178.

BNB, the token originally launched as Binance Coin and used to pay fees on the platform, fell 5% in the past 24 hours and traded at $709.70, according to CoinGecko.

Among stocks, Coinbase Global fell 4.8%, while Strategy, the company focused on buying bitcoin, dropped nearly 6% in after-hours U.S. trading.

Beyond the loss of assets, the breach is likely to have wider repercussions for the sector, which is already under pressure from higher U.S. interest rates and weaker demand from exchange-traded fund buyers, analysts said.

“This could further dampen risk appetite and lead investors to reassess the safety of assets held on centralized platforms, as well as counterparty, solvency and liquidity risks,” said Tim Sun, an analyst at Hong Kong-based HashKey Group.

The episode adds to other cryptocurrency thefts. Last year, attackers stole $2.9 billion in nearly 150 attacks, according to TRM Labs researchers. In September, the Bitget platform reported that about $350 million had been stolen.

Authorities have warned that organized crime groups are increasingly using cryptocurrencies to move funds across countries outside the traditional financial system.