Binance, the world’s largest cryptocurrency exchange, has confirmed a massive security breach resulting in the theft of approximately $6.3 billion. The company, co-founded by Chinese-born Canadian billionaire Changpeng Zhao, halted all deposits and withdrawals on Thursday while assuring users that their funds remain secure and that the exchange will cover all losses.
Blockchain analysis firms TRM Labs and Chainalysis reported that the majority of the stolen assets were moved out of Binance wallets across 10 different blockchains within a roughly 20-minute window late Thursday. “An attacker moved approximately 6.36 billion USD out of Binance wallets on 10 blockchains,” TRM reported. However, chainalysis reached the same conclusion.
The scale of the theft significantly exceeds the previous record of $1.5 billion stolen from Bybit in February 2025. Binance has successfully frozen about $3 billion of the assets, with stablecoin issuers Tether and Circle accounting for more than $2.3 billion of that recovery. However, the company has not yet accounted for the remaining $3.3 billion and warns the total theft figure may rise. It also warned on X that the $6.3bn figure “may continue to increase” as the company works to trace and freeze more assets. In December 2022, South Korea’s spy agency estimated that North Korean hackers had stolen about 1.5 trillion won ($1.1bn) in crypto and other virtual assets over five years. “When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity,” Ari Redbord, TRM’s global head of policy, told, adding, “That makes this a global security issue. The Secure Asset Fund for Users, set up in 2018 and held entirely in Bitcoin to protect users in case of a breach, the stolen sum is more than six times Binance’s $1bn emergency fund. Is crypto an inherently unsafe investment.
While Binance co-CEO Richard Teng stated that the investigation has not yet attributed responsibility to specific individuals, external analysts at TRM Labs have assessed with high confidence that the attack was executed by TraderTraitor, a North Korean hacking unit affiliated with the Lazarus Group. The Lazarus Group “targets and compromises entities primarily in South Korea and South Korean interests for espionage, disruption, and destruction”, according to the Council on Foreign Relations (CFR).
This group is widely known for targeting financial institutions and cryptocurrency exchanges to fund North Korea’s state activities, including its nuclear weapons program.
The US Treasury sanctioned the Lazarus Group in 2019, though Pyongyang consistently denies any involvement in international cybercrimes. Saying it was controlled by North Korea’s primary intelligence bureau, the US Department of the Treasury sanctioned the Lazarus Group in 2019. It has become a much-needed source of foreign currency for Pyongyang, helping to prop up its economy and fund its nuclear programme, which is under United Nations sanctions, experts say, while North Korea denies involvement in crypto theft. Though markets steadied after the initial shock, prices have fallen. Analysts told Reuters, the hack comes as crypto had already been under pressure from higher US interest rates and weaker demand from exchange-traded fund buyers. “Any assets held at a centralised exchange are only as safe as the exchange itself, and the larger the exchange’s holdings, the larger a target it becomes,” Sean Foley, an expert in crypto markets at Macquarie University.
Regarding the technical nature of the breach, Binance initially suggested a compromised laptop belonging to an engineer might have been the entry point, but later clarified that multiple points of breach were discovered. Although the exchange found no evidence that private keys were leaked, industry expert Mark Karpeles, formerly of Mt Gox, suggested the attackers likely accessed keys for at least two major wallets. Binance is currently coordinating with law enforcement and expects to resume withdrawal services within 45 hours.
The incident has triggered a downturn in the broader crypto market, with Bitcoin dropping to a six-week low of $76,368 and Ether falling more than 3 percent to a two-month low. And what does it mean for the crypto market, so how did it happen. Bitcoin hit a six-week low of $76,368, while Ether fell more than 3 percent to a two-month low of $2,178.
Coinbase shares also dipped by 4.8 percent.
The theft highlights ongoing vulnerabilities for centralized exchanges, which hold large asset reserves that attract sophisticated bad actors.
With crypto-specific insurance remaining a niche sector, the event serves as a stark reminder of the risks associated with centralized storage, especially given that the $6.3 billion loss far outweighs the $1 billion in the company’s Secure Asset Fund for Users. And crypto-specific cover remains a niche business offered largely by specialist insurers, insurance offers limited protection as most crime- and cyber-insurance policies do not cover stolen cryptocurrency.
This major heist adds to a growing list of security challenges for the industry; in 2025 alone, hackers stole an estimated $2.87 billion across nearly 150 separate attacks. Binance has faced previous regulatory and legal scrutiny, most notably when Changpeng Zhao pleaded guilty to a felony in 2023 for failing to prevent money laundering, a charge for which he received a presidential pardon from Donald Trump in 2025. According to TRM’s 2026 Crypto Crime Report, hackers stole $2.87bn in crypto in nearly 150 attacks in 2025. US President Donald Trump pardoned him in 2025.
