The world's largest crypto exchange said a compromised engineer's laptop let an attacker submit unauthorized withdrawals. It pledged to cover all losses from its insurance fund and company money. Tether and Circle froze about $2.4 billion of stablecoins, and two analytics firms linked the attack to North Korea.
The world's largest crypto exchange disclosed a breach on Thursday whose estimated impact, on the figures reported so far, exceeds any crypto theft on record. Within hours, a large share of the affected money had stopped moving.
Binance said late Thursday that "the estimated total impact sits at around $6.3B" and that about $3 billion had been "frozen on-chain so far" with the help of blockchain partners. The company said "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe." SAFU is the exchange's emergency insurance fund.
The impact estimate is more than four times the roughly $1.5 billion stolen from the exchange Bybit in February 2025, which had been the largest crypto theft on record.
How it happened, according to Binance
Binance said its initial investigation points to a breach that "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." It said, "We have found no evidence of any wallet private key leak." It revoked the affected address authorization, engaged law enforcement and said it would publish an updated proof of reserves once remediation is complete.
The sequence took about eight hours to become clear. A blockchain researcher flagged unusual outflows at 4:32 p.m. ET on Thursday. At 5:16 p.m. Binance said it was "aware of reports of a potential security issue" and had "not confirmed any impact to user funds." Its $6.3 billion estimate came at about 10:23 p.m. At 12:36 a.m. on Friday it said deposits were operating normally and that withdrawals remained paused, adding: "We expect to resume within 48 hours."
The freeze
The speed of the freeze is the other half of the story. Tether froze more than $1.567 billion of its USDT stablecoin and Circle more than $800 million of USDC, about $2.4 billion between them. Other stablecoin issuers and decentralized protocols also froze or blocked funds.
If both of Binance's figures hold, roughly $3.3 billion of the affected assets remains unfrozen, by our arithmetic.
Who did it
Binance has not named an attacker. Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a hacking group linked to North Korea. Law enforcement has not publicly confirmed the attribution.
The market
BNB, the token tied to Binance's ecosystem, fell about 5.2% to about $705.95 from Thursday afternoon, after touching about $683. Bitcoin briefly fell to about $76,300, though its decline began before the breach was public.
Standard Chartered said the breach could accelerate a shift toward decentralized exchanges.
Contained or contagious?
The contained view: Binance says it will cover every loss, deposits are working, about half the affected assets are frozen, and the exchange expects to reopen withdrawals within two days.
The contagion view: withdrawals at the largest exchange are paused, about $3.3 billion of affected assets has not been frozen, and any sale of those assets would hit thin markets.
There is also a structural point. The freeze worked because centralized stablecoin issuers and protocols can stop tokens from moving. That protected users this time. It also shows how much control those intermediaries hold over assets often described as beyond anyone's reach.
What to watch
Whether withdrawals resume within Binance's 48-hour window, the updated proof of reserves, the full post-mortem, any law-enforcement statement on attribution, and movements from the attacker's wallets.