Hackers have stolen approximately $6.3 billion from Binance, the world’s largest cryptocurrency exchange, in what industry analysts are calling the largest cyber heist in digital asset history. The incident has again highlighted concerns regarding cybersecurity and the systemic risks of holding funds on centralised trading platforms. Blockchain intelligence firms TRM Labs and Chainalysis reported that the threat actors behind the coordinated attack originated from North Korea. According to TRM Labs, the attackers targeted Binance wallets across 10 distinct blockchains, siphoning the vast majority of the funds within an estimated 20-minute window.According to news agency Reuters, TRM Labs stated with “high confidence” that key characteristics of the intrusion closely mirror previous North Korean-sponsored operations, including a major 2025 cyberattack against cryptocurrency exchange Bybit that was formally tied to Pyongyang by the US Federal Bureau of Investigation (FBI).
Compromised laptop suspected as entry point
Reuters reported that preliminary internal inquiries by Binance suggest the breach began through a single compromised endpoint. According to the exchange, unauthorised access was gained after an engineer’s laptop was hacked, allowing the attacker to infiltrate an internal network system and execute unauthorised fund withdrawals.“The incident stems from multiple factors. Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident,” Binance stated. Aravind Srinivasan, head of the systematic OTC business at cryptocurrency market maker GSR, described the unprecedented scale simply as “the biggest hack in history.”
Binance Co-CEO Richard Teng to users: ‘Your money is safe’
In response to the incident, Binance co-CEO Richard Teng posted a direct message on X for users to quell market panic and address solvency fears.I want to speak to you directly about what happened.Bottom line – your money is safe, and we’re covering every loss.Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.So far, we have found no evidence of any wallet private key leak.We’ll share a detailed technical post-mortem once the investigation is complete and every fact is verified – and publish an updated Proof of Reserves once remediation is complete.What you need to know:• Your funds are safe• Binance will cover all losses from the SAFU fund and company funds• Estimated total impact: ~$6.3B, with ~$3B frozen on-chain so far, in coordination with our blockchain partners• No evidence of any wallet private key leak• Deposits are unaffected and operating as normalWhat we’ve done:• Temporarily suspended withdrawals while we complete a security revamp of the withdrawal service and its related addresses• Revoked the affected address authorizations• Engaged law enforcement and blockchain intelligence partners to trace and recover fundsOur team hasn’t stopped. We’re working closely with law enforcement to ensure the matter is handled appropriately – and I’ll share what I can, as soon as I can.
