- Binance confirmed the attack and estimates the value of unauthorized withdrawals at approximately $6.3 billion. This is approximately 4 times more than the theft from Bybit in 2025, the largest in the history of cryptocurrencies so far.
- Okay. USD 3 billion was frozen. However, the freeze does not mean that the money has returned to Binance.
- Withdrawals are suspended and the exchange announces their resumption within 48 hours. The losses are to be covered from the SAFU fund and its own resources.
The attack started on an employee’s laptop
According to Binance’s preliminary findings, the attacker took over the laptop of one of the DevOps engineers. Thanks to this, he got into the container of the withdrawal service and ordered unauthorized transactions.
The exchange writes that it has found no evidence of leakage of private wallet keys. She did not explain how the laptop was seized. A detailed technical report is expected to be published once the investigation is completed.
Analysts point to North Korea
TRM Labs highly confidently attributes the attack to the TraderTraitor group, i.e. hackers associated with North Korea. The same unit was identified by the FBI after the theft of approximately USD 1.5 billion from Bybit in February 2025. Jonathan Levin from Chainalysis has a similar opinion.
This is an assessment by analytical companies, not a finding by law enforcement agencies. Binance did not identify the perpetrator and writes that it is cooperating with the police to identify him.
Approximately $3 billion was frozen
Binance reports that, together with stablecoin issuers and industry partners, it has frozen assets worth approximately $3 billion. TRM Labs counted approximately $2.7 billion. The difference may result from the time of measurement, rates and counting method.
Most of this amount is stablecoins locked by issuers, primarily Tether and Circle. These tokens cannot be forwarded. This does not mean that the money has returned to Binance accounts.
The rest remains beyond the reach of issuers. According to TRM Labs, the attacker still controls, among others, over 420 thousand ETH and 18,270 BTC, worth approximately $2.4 billion at the time of analysis.
How the attacker bypassed some of the blockades
This maneuver allowed us to replace stablecoins, which the issuer can block, with ETH, which cannot be blocked. The attacker paid for it with the difference between the security and the loan. Aave states that the position is overcollateralized and there is no risk of loss to people who lend their funds on the protocol. This is approximately 1% of the stolen amount, so it does not change the scale of the entire theft.
Aave also preventively froze 175 V3 markets on 16 networks and 117 V4 markets. You can’t deposit or take out new loans there, but repayments, withdrawals and liquidations work as normal.
Back in August, CZ argued that the stock exchange was safer
These numbers are not just about burglaries. On the self-storage side, there are also lost keys, damaged drives, and coins that have not been touched since the early days of bitcoin. However, the attack on Binance shows the other side of this calculus: when someone hacks into the exchange’s wallets, all of its customers are affected at once.
Expert: suspension of payments is routine
Łukasz Żeligowski, an expert at Kanga Exchange EU, explains why the seizure of one laptop may be enough for such a large theft, even without leaking private keys.
Malware can not only intercept passwords, API keys or confidential information, but can act independently and order operations that were not planned. Łukasz Żeligowski, Kanga Exchange EU expert
According to him, withdrawals from Binance looked like an ordinary move, and the entire operation took less than 20 minutes. He assesses the stock exchange’s reaction as very quick and, based on current information, he does not see any significant omissions. He considers the suspension of payments to be standard and not a sign of bigger problems.
Suspending withdrawals (and often deposits) is a natural step. It’s a bit like suspending quotations on the stock exchange when the price changes too rapidly. It gives you time to sort things out and cool down your users’ emotions. Łukasz Żeligowski, Kanga Exchange EU expert
He sees the most important lesson in scale. One huge stock exchange is a tasty morsel, because one hack gives access to a lot of money. An exchange 100 times smaller than Binance has 100 times less funds, so even with weaker security it is a less attractive target for a burglar.
What does this mean to you
Binance ensures that users’ funds are safe and promises to cover losses from the SAFU fund and its own money. The attack targeted wallets controlled by the exchange, not individual customer accounts.
You will be informed about the resumption of withdrawals only in the application and on the official Binance website. Do not click on links to alleged compensation from news and comments, because fraudsters are already impersonating the exchange. Binance doesn’t need your password, authentication code or recovery phrase to secure your account.
Interestingly, the bitcoin price did not react dramatically. We are seeing declines of 3-4%, but the incident occurred less than 24 hours ago, so the rate may now be very volatile.
What is not known yet
The final amount may change once transfers between networks have been agreed. It is not known when exactly wages will be returned, how much of the frozen funds will be recovered or how the employee’s laptop was seized. Binance has not published the full technical report yet.
