Binance reports $6.3bn crypto heist, the largest in history

Assesses with high confidence that TraderTraitor, a North Korean unit linked to the Lazarus Group, carried out the attack, and reports that the attacker moved about $6.36bn out of Binance wallets on 10 blockchains.

“"An attacker moved approximately 6.36 billion USD out of Binance wallets on 10 blockchains"”

Suspends deposits and withdrawals, says user funds are safe and that it will cover all losses, warns the $6.3bn figure may rise as tracing continues, and says it has found no evidence that any wallet private key leaked.

Says the company's investigation has not attributed responsibility for the breach to any individual.

“"Our investigation has not attributed responsibility to any individual."”

Argues that North Korean thefts at this scale fund weapons proliferation and other destabilising activity, making the hack a global security issue rather than just a crypto theft.

“"When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity"”

Reaches the same conclusion that the attack originated in North Korea.

Says the attackers probably accessed the keys for at least two Binance wallets.

Warns that assets held at a centralised exchange are only as safe as the exchange itself, and that the larger the exchange's holdings the larger a target it becomes.

“"Any assets held at a centralised exchange are only as safe as the exchange itself, and the larger the exchange's holdings, the larger a target it becomes"”

Describes the Lazarus Group as compromising South Korean entities for espionage, disruption and destruction while also running cyber operations for financial gain, including against cryptocurrency exchanges.

Sanctioned the Lazarus Group in 2019, saying it was controlled by North Korea's primary intelligence bureau.

Blamed the 2025 Bybit hack on the same North Korean hacking unit.

Estimated in December 2022 that North Korean hackers had stolen about 1.5 trillion won ($1.1bn) in crypto and other virtual assets over five years.

Pleaded guilty in 2023 to a felony linked to failing to prevent money laundering on the platform.

Pardoned Changpeng Zhao in 2025.

Estimates the breach at about $6.3bn, reports roughly $3bn of assets frozen and possibly more to come, traces the incident to a compromised engineer's laptop, denies any private key leak, suspends deposits and withdrawals, and pledges to cover all losses from the SAFU fund and company funds.

Estimates about $6.36bn was transferred out of Binance wallets across 10 blockchains, mostly within 20 minutes, and attributes the operation with high confidence to the North Korean hacking group TraderTraitor.

Says its preliminary investigation points to a compromised laptop belonging to a DevOps engineer, puts the impact at about $6.3bn with roughly $3bn frozen, insists user funds are safe, pledges to cover losses through SAFU and company funds, and reports no evidence of leaked private keys.

Attributed the March 2022 Ronin Network attack to the North Korean state-sponsored Lazarus Group.

Attributed the February 2025 Bybit theft to North Korea as part of the TraderTraitor campaign, saying attackers converted assets and spread them across thousands of addresses on multiple blockchains.

Said the attacker began returning the stolen assets within days and offered a $500,000 reward for information about the vulnerability and the return of the funds.

Said the attacker exploited a flaw in cross-chain message verification and coordinated with validators to suspend operations and limit the movement of affected assets.

Published a technical analysis explaining how the attacker forged security proofs to exploit the BSC Token Hub bridge.

Said it later compensated affected customers for the stolen funds.

Ordered improvements to Coincheck's operations and examined security arrangements at other cryptocurrency exchanges after the 2018 theft.

Patched the software vulnerability behind the September 2026 theft, after which about 85 percent of the roughly $319m was returned.

Says user funds are safe and it is covering the incident's impact with more than $6.34 billion in reserves including SAFU and $5 billion in the exact affected token assets; it found no private-key leak, about $3 billion was frozen, and withdrawals were temporarily suspended while it coordinates with law enforcement and blockchain partners.

“Your funds are safe; Binance is covering the impact of this incident, not you,”

Attributes the attack with high confidence to TraderTraitor, an elite cybercrime group sponsored by North Korea.

Says several elements of the attack resembled earlier North Korean-linked incidents, including the Bybit hack.

Says it has frozen about half the stolen funds, set aside more than $6.34bn of company money and is actively buying crypto tokens, and assures users that their money is safe and every loss is covered.

“"your money is safe, and we're covering every loss"”

Says the attack was not carried out by one person, that investigation moved from a suspected compromised laptop to additional points of breach, and that the hackers used a self-destruct mechanism to destroy tooling and traces as they went.

“"This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach."”

Says it has high confidence that a North Korean actor is linked to the hack.

Says it is working around the clock to identify, freeze, trace and recover the stolen funds and will identify the cyber criminals responsible and bring them to justice.

“"identify the cyber criminals responsible and bring them to justice"”

Says customers' ability to recover losses depends on what their contracts promise and on where Binance can be sued for non-performance.

“"come down to what [customers] have been promised in their contracts"”

Says $6.3 billion of digital assets were impacted, about half were frozen, it will cover all losses, initial checks suggested a compromised engineer laptop but subsequent investigation found additional breach points, and it is working with law enforcement to identify the criminals.

“We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.”

Says the hack began with a compromised engineer's laptop giving access to a service container for unauthorized withdrawals, but was a complex attack not a single one-click action and no wallet private-key leak was found.

“To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak.”

Calls the Binance hack a watershed moment unlike anything the industry has seen, with the attacker still holding a huge sum and recovery efforts far from over.

Thanks cryptocurrency issuers for freezing assets and says withdrawals are disabled until the environment is confirmed secure.

“Safety first: withdrawals are currently disabled until the environment is confirmed to be secure,”

Says it froze assets as part of a combined total of about $2.4 billion frozen with Circle in response to the potential Binance hack.

Says it froze assets as part of a combined total of about $2.4 billion frozen with Tether in response to the potential Binance hack.

Says it worked with partners to freeze stolen funds.

Says it was unaffected and is monitoring the situation.

Urges every exchange to remain vigilant because platforms are attractive targets due to the value of assets.

Says the Binance losses make it the largest crypto theft on record and the attack resembles the Bitget hack, implying attackers now target systems and people with authority rather than vault keys.

“This implies that attackers no longer need the vault keys. They target the systems and people with authority to use them.”

Says several elements of the Binance attack resemble earlier North Korea-linked incidents including the 2025 Bybit hack.

Says the hack was not a simple one-click action but a complex multi-step attack using a self-destruct mechanism to hide tracks, and that all losses will be covered.

Suggests an engineer may have been talked into taking a test, letting malware land on an already privileged laptop and become the route to production and wallets.

Argues that sophisticated vaults fail if the person holding the keys can be duped.

“You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened.”

Says Pyongyang runs a state cyber-warfare agency used to fund weapons programs and the regime.

“about 40 – 50% of North Korea's weapons of mass destruction programmes are funded by cyber and crypto-currency warfare”

Says the incident exposes the fragility of parts of the crypto ecosystem and will accelerate scrutiny of how the sector protects infrastructure and customers.

Says the incident was not the work of one person, that a compromised laptop was an initial lead with additional breach points found later, and that a self-destruct mechanism deleted traces.

Says it is working around the clock to identify, freeze, track and recover the stolen funds and will hold the cybercriminals accountable.

Says reimbursement will depend on what customers were promised in their contracts and whether Binance can be held liable for non-performance.

“будет зависеть от того, что [клиентам] было обещано в их контрактах” ru

Says the attackers compromised Binance's signing infrastructure to issue instructions emptying the wallets, and is highly confident the same North Korean group behind the Bybit hack was responsible.

Says it initially thought a laptop was compromised but subsequent investigation uncovered additional points of breach.

“"However, our subsequent investigation has uncovered additional points of breach"”

Says losses would be covered by the Secure Asset Fund for Users and company resources, and that Binance's investigation had not yet identified the attackers.

Says funds stolen in last month's attack on Bitget were being mixed with proceeds from the Binance breach.

Explains that the attacker may not have stolen the vault key but hijacked the system that tells the vault to release money.

“"In layman's terms, the attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money"”

Notes that no company issues or can freeze bitcoin and ether, so those funds can only be stopped if sent to a willing exchange or broker or if law enforcement obtains the private keys.

“"No company issues bitcoin or ether and no company can freeze either one"”

Says the longer time passes the less likely attackers can fold the funds into other exchanges or payment providers, because the assets effectively become blacklisted.

“"The more time passes, the less likely they will be able to fold those funds into other exchanges or payment providers — they essentially get blacklisted"”

Values the global crypto insurance market at $9.37 billion in 2025 and projects it to reach $184.98 billion by 2033, citing growing institutional adoption and rising cyberattacks and digital asset theft.

Says digital asset firms and institutional clients must understand precisely what is covered, where exclusions and sublimits apply, and which risks are retained; given possible gaps between losses and insurance capacity, technology, security controls, governance, and financial strength are equally important to resilience.

“Digital asset firms and, increasingly, their institutional clients need to understand precisely what is covered, where exclusions and sublimits apply, and which risks are retained, Given the potential gap between probable/possible loss and available insurance capacity, technology and security controls, strong governance and financial strength are equally important to resilience.”

Says the attack involved a more complex process rather than misuse of a single engineer's permissions, and that withdrawals are suspended and address authorizations revoked.

Says it is aware of the incident and coordinating with public and private partners to assess scope and impacts.

Says deposits remained unaffected and normal, while the exchange works on withdrawal-service and address-control enhancements.

Says Tether froze more than $1.5 billion of its stablecoin that may be related to the breach.

Says Circle froze more than $800 million in USD Coin associated with the incident.

Says the hack proves the case for a proposed federal framework, arguing unregulated offshore exchanges lack US-style safeguards.

“The real issue here is that these are unregulated offshore exchanges, and they don't have the same sorts of safeguards that we have in our financial markets here in the United States.”

Says North Korea's TraderTraitor sub-unit is likely behind the attack, with high confidence.

Says the firm assesses the hack was likely carried out by the DPRK-linked group TraderTraitor, citing links to earlier attacks.

Says the attacker is very likely Lazarus.

“很可能是 Lazarus” zh

Says the tactics and sophistication seen match operations previously observed from the DPRK.

Brought the crypto market under its supervision with 2024 regulations and 2025 communiqués on custody, information-system security, reserve audits and outsourcing, though compliance across platforms is unclear.

Says the estimated total impact is around $6.3 billion, about $3 billion is frozen on-chain, and it will cover all losses from SAFU and its own money.

Had issued Binance a no-objection certificate, which it says is not a full operating licence, and had posted nothing about the incident as of the article's publication.

Established the Secure Asset Fund for Users in July 2018 as an emergency reserve, which as of 2026 holds roughly $1bn entirely in bitcoin; the company did not immediately respond to a request for comment on its insurance coverage.

Values the global crypto insurance market at $9.37bn in 2025 and projects it to reach $184.98bn by 2033, citing institutional adoption and rising cyberattacks and digital asset theft.

Says it has high confidence that TraderTraitor orchestrated the Binance hack, citing robust on- and off-chain intelligence and similarities to earlier North Korea-linked heists.

“Several features of this attack match earlier North Korea-linked heists,”

Says it is resolving a complex attack affecting around $6.3 billion, roughly $3 billion was frozen, additional breach points exist beyond a single compromised laptop, user funds are safe and all losses will be covered, deposits are unaffected, and withdrawals are expected to resume in 45 hours.

“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,”

Says it is becoming very hard to counter hacks because AI can find vulnerabilities faster than they can be fixed, and users will move away from smaller and medium-sized exchanges too risky to cover meaningful hacks.

“It’s becoming very hard to counter hacks as AI can find vulnerabilities faster than you can fix them,”

Says $27 million in stablecoins and about $2 million worth of World Liberty tokens had been frozen.

Says it worked with crypto custodian BitGo to freeze funds stolen in the Binance hack.

Says Tether froze about $1.6 billion related to a potential Binance exchange hack.

“related to a potential Binance exchange hack.”

Says Circle froze more than $800 million in USDC.

Says it was unaffected and is monitoring the situation.

Temporarily halted trading after a security incident involving a third-party provider, later resumed trading, and said it would fully reimburse affected traders.

Says Ripple is closely monitoring reports of a potential exploit involving Binance, freezing affected funds, and coordinating with relevant parties.

Says North Korean hackers are highly likely behind the attack, and that attackers stole $2.9bn in nearly 150 incidents last year.

Says it worked with partners to freeze affected assets and has located about $3bn, that user funds are safe, and that all deposits and withdrawals are suspended as a precaution while experts check systems, secure wallet infrastructure and trace assets with law enforcement and industry partners.

“»Die Gelder der Nutzer sind sicher«” de

Warns that defending against hacker attacks is becoming ever harder because AI can find vulnerabilities faster than they can be fixed, and predicts users will turn away from small and mid-sized exchanges that could not absorb losses from a major hack.

“»Es wird immer schwieriger, Hackerangriffe abzuwehren, da KI Schwachstellen schneller finden kann, als sie behoben werden können«” de

Says the company will replace all losses from the hacker attack, and details the sums frozen by Tether, Circle, World Liberty Financial and Ripple, which leave less than half of the stolen cryptocurrencies secured.

“»alle Verluste aus dem Hackerangriff«” de

Says the incident could further dampen risk appetite and push investors to reassess the safety of assets held on centralised exchanges and the risks around counterparties, solvency and liquidity.

“»Er könnte die Risikobereitschaft weiter dämpfen und Anleger dazu veranlassen, die Sicherheit von auf zentralisierten Börsen gehaltenen Vermögenswerten sowie die Risiken in Bezug auf Gegenparteien, Solvenz und Liquidität neu zu bewerten«” de

Says it has frozen assets worth almost $1.57bn.

Froze more than $800m of the affected assets.

Says it worked with crypto custodian BitGo to freeze stolen funds.

Froze funds worth around $200m, according to Yi He.

Suspended withdrawals immediately after the hack, blocking cross-exchange liquidity and deepening trader losses according to the article.

Warns that disrupted deposit and withdrawal routes are crippling market makers’ ability to move capital between platforms and could fuel irrational price swings.

Notes that in the first hours after the news bitcoin bid-ask spreads widened as much as fivefold and ether up to 2.5-fold as market makers withdrew from order books.

Says prices have further to fall until frozen assets are released and more details of the hack emerge, arguing the market has not reached a new support floor.

“«تا زمانی که دارایی‌ها از حالت انجماد خارج نشوند و جزئیات دقیق‌تری از ابعاد این هک منتشر نگردد، بازار به کف حمایتی جدیدی دست نخواهد یافت.»” fa

Announced a partnership with TradeXYZ to develop regulated perpetual-futures markets in the US using Hyperliquid infrastructure.

Says initial investigations suggest the security incident may have resulted from hacking a personal computer of a development operations engineer, no evidence of private-key leaks was found, estimated damage is about $6.3 billion, nearly $3 billion was frozen on-chain, all losses will be covered through the user insurance fund and company resources, user assets are safe, deposits and withdrawals were temporarily suspended, and a proof-of-reserves report will be published.

Concludes with high confidence that North Korea's TraderTraitor unit carried out the theft, describing how EIP-7702 delegation turned Binance's hot wallet into a sweeper with 50 pre-signed authorizations while other chains were drained via ordinary transactions.

“«Це найбільша крадіжка криптовалюти за всю історію — її обсяг приблизно в чотири рази перевищує суму коштів, викрадених у результаті злому біржі Bybit у лютому 2025 року ($1,5 млрд). Компанія TRM пов’язує цю атаку з угрупованням TraderTraitor — елітним північнокорейським хакерським підрозділом. Ми робимо цей висновок із високим ступенем впевненості»” uk

Says its preliminary review suggests hackers used a compromised DevOps engineer's laptop to access a work container and make unauthorized transactions; no private keys leaked, customer funds are safe, losses will be covered by SAFU and own funds, and it will publish a technical report.

Froze stablecoins worth part of about $2.67 billion linked to the hack.

Froze stablecoins worth part of about $2.67 billion linked to the hack.

Froze stablecoins worth part of about $2.67 billion linked to the hack.

Froze stablecoins worth part of about $2.67 billion linked to the hack.

Blocked 8,426 ETH and 74.6 million ARB tokens.

Attributes the attack with high confidence to North Korea’s TraderTraitor unit and calls it the largest cryptocurrency theft ever recorded.

““TRM atribuye el ataque a TraderTraitor, la unidad de hackers de élite de Corea del Norte, basándose en sólida inteligencia dentro y fuera de la cadena de bloques”” es

Says a compromised engineer laptop may have been involved, that it found no evidence of private-key leaks, and that it will cover all losses while working with authorities.

““No hemos encontrado evidencia de ninguna filtración de claves privadas de billeteras”” es

Says attackers are operating at unprecedented speed and scale, but tracking tools and stablecoin issuers can also respond within hours and in real time.

““Los atacantes están operando a una velocidad y escala sin precedentes”” es

Says Binance will cover all losses and that user funds are safe, with withdrawals expected to resume on Sunday.

““los fondos de los usuarios están seguros”” es

Says rumors of the hack were definitely pushing crypto prices down because Binance is so large that any hit to confidence in it hits confidence in the whole sector.

““definitivamente estaban haciendo bajar los precios de las criptomonedas”” es

Says Tether froze more than $1.5bn of USDT linked to a possible Binance hack.

““relacionados con un posible hackeo de la plataforma Binance”” es

Says Circle froze $800m of its stablecoin amid reports of a possible attack involving Binance.

““informes sobre un posible ataque que involucra a Binance”” es

Calls the hack enormous damage to crypto because repeated successful attacks make the sector dangerous in an era of rapid AI model releases.

““Es un enorme daño para las criptomonedas debido a los reiterados hackeos exitosos en el sector”” es

Says it temporarily suspended all deposits and withdrawals as a precaution while conducting security checks, freezing funds, and cooperating with authorities; customer funds are safe, it will cover any losses, and about $2.54 billion was frozen.

“Como medida de precaución, todos los depósitos y retiros quedan temporalmente suspendidos mientras nuestro equipo realiza comprobaciones de seguridad, congela los fondos y colabora con las autoridades” es

Says the incident did appear to be a hack against the platform and expresses confidence that user funds will be covered.

Reports that Tether froze about $1.6 billion related to the possible hack.

Reports that Circle froze more than $800 million in USDC.

Says Binance complies with applicable regulatory requirements in the jurisdictions where it operates and is actively working toward MiCA authorization.

“In Europe, Binance remains committed to operating on a long-term, compliant basis under the EU's Markets in Crypto-Assets Regulation. We are actively working toward becoming MiCA-authorised.”

Says the reverse-solicitation exemption is very narrowly framed and must be treated as the exception rather than used to circumvent MiCA, while supervision and enforcement remain national competences.

“The reverse solicitation exemption should be understood as very narrowly framed. It should be regarded as the exception and not be used to circumvent MiCA requirements.”

Says crypto asset service providers cannot simply claim reverse solicitation and must meet clear requirements and guidelines.

“Crypto asset service providers cannot simply claim reverse solicitation: there are clear requirements and guidelines that must be met.”

Says attackers compromised Binance’s signing infrastructure and attributes the breach with high confidence to North Korea-linked hackers, noting similarities to the Bybit attack.

Says it initially believed a compromised laptop was the entry point but found additional breach points in a sophisticated attack.

““However, our subsequent investigation has uncovered additional points of breach””

Says losses will be covered by Binance’s Secure Asset Fund for Users and company resources.

Says funds stolen in last month’s Bitget attack were being mixed with proceeds from the Binance breach.

Explains the attackers may not have stolen the vault key but hijacked the system that authorizes releases.

““In layman's terms, the attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money,””

Says bitcoin and ether cannot be frozen by any issuer and can only be stopped if sent to a cooperating exchange or if law enforcement obtains private keys.

““No company issues bitcoin or ether and no company can freeze either one,””

Says the window to launder stolen funds is only the first few hours, after which marked funds are blacklisted and can sit for years.

““The more time passes, the less likely they will be able to fold those funds into other exchanges or payment providers – they essentially get blacklisted,””

Assesses that the attack was highly likely carried out by North Korean hacking group TraderTraitor, which was also blamed for the Bybit hack.

Says about $3 billion of the stolen assets has been frozen and that customer assets are safe, with losses to be covered by the user protection fund and company funds.

““고객 자산은 안전하며 손실은 이용자 보호기금과 회사 자금으로 보전하겠다”” ko

Froze assets in wallets linked to the hack.

Froze assets in wallets linked to the hack.

Established virtual-asset-exchange-specific security evaluation standards covering blockchain, wallets, smart contracts, servers, and networks, but no operator had applied for the comprehensive security check as of Oct. 19.

Says hackers compromised Binance’s signing infrastructure and attributes the breach to North Korea-linked TraderTraitor with high confidence, noting similarities to Bybit.

Says a complex attack caused multiple breaches, that an initially suspected compromised laptop was not the only vulnerability, and that it aims to resume withdrawals in 45 hours while covering all losses.

“„Ancheta noastră preliminară privind acest incident indica un laptop a cărui securitate a fost compromisă. Cu toate acestea, investigațiile noastre ulterioare au scos la iveală alte puncte vulnerabile”” ro

Says losses will be covered from the SAFU fund and company resources.

Says funds stolen in last month’s Bitget attack were being mixed with proceeds from the Binance breach.

Explains the attacker may not have stolen the vault key but may have taken control of the system that orders the vault to release money.

“„În termeni simpli, este posibil ca atacatorul să nu fi furat cheia seifului, ci să fi preluat controlul asupra sistemului care ordonă seifului să elibereze banii”” ro

Says no company issues bitcoin or ether and no company can freeze either one, so they can be stopped only through a cooperating exchange or law enforcement obtaining private keys.

“„Nicio companie nu emite bitcoin sau ether și nicio companie nu poate îngheța niciuna dintre acestea”” ro

Says the longer time passes, the less likely attackers can move the funds to other exchanges or payment providers because the assets effectively become blacklisted.

“„Cu cât trece mai mult timp, cu atât este mai puțin probabil ca aceștia să poată transfera fondurile respective către alte platforme de tranzacționare sau furnizori de servicii de plată — practic, ajung pe lista neagră”” ro

Attributes the attack to North Korea’s elite TraderTraitor hacking unit with high confidence and says about $6.36bn was moved across ten blockchains in roughly 20 minutes.

““Emitimos este juicio con un alto grado de confianza”” es

Says user funds are safe and the theft does appear to be a hack against Binance, and as a shareholder expects all user funds to be fully covered.

““los fondos de los usuarios están seguros”” es

Calls it the largest cyberattack in history.

““Es el mayor ataque informático de la historia”” es

Says the Binance attack was probably carried out by the North Korean TraderTraitor group.

““probablemente fue realizado por el grupo norcoreano TraderTraitor”” es

Says Binance is working closely with security partners to confirm the attackers’ identity and bring them to justice.

““trabajando estrechamente con nuestros socios de las fuerzas de seguridad para confirmar la identidad de los delincuentes y llevarlos ante la Justicia”” es

Says the breach looks like a single signature that gave the attacker a full, non-expiring access token to a Binance hot wallet.

““Esto parece una sola firma que le otorgó al atacante un token de acceso total y sin vencimiento a una billetera caliente de Binance”” es

Says the estimated total impact is around $6.3 billion, about $3 billion is frozen on-chain, no private keys leaked, and all losses will be covered via SAFU and company funds.

Says no significant impact on Thai client assets has been found so far and instructs licensed digital asset operators to monitor risk, verify asset security, report incidents and communicate accurately with customers.

Says hackers attacked Binance wallets on ten blockchains and moved most of the funds in about 20 minutes.

Says its initial investigation pointed to a compromised engineer laptop and that it found no evidence private-key data leaked; it suspended withdrawals and expected to restore them within 48 hours.

Says hackers may have obtained private keys for at least two Binance wallets.

Says Binance will cover all damage from the hack using its customer protection fund and company funds.

Blocked part of more than $2.3bn in stolen stablecoin assets alongside Circle.

Blocked part of more than $2.3bn in stolen stablecoin assets alongside Tether.

Froze nearly $29m in assets linked to the Binance hack.

Froze nearly $200m in assets linked to the Binance hack.

Identifies North Korea’s TraderTraitor hacking group as the likely perpetrator, linking the incident to the Bybit hack.

Says its internal DevOps engineer’s laptop may have been compromised, has suspended deposits and withdrawals for a security review, and pledges to compensate all losses through SAFU and company funds.

“"내부 데브옵스(DevOps·개발 및 운영) 엔지니어의 노트북이 침해됐을 가능성이 있다"” ko

Reports that stolen assets moved across Bitcoin, Ethereum, Tron, Ripple and Layer 2 networks, and that Binance froze about $3bn, roughly 47.5% of the stolen amount, through industry cooperation.

Says no direct damage to Korean exchanges or investors has been confirmed, and that Binance’s prompt suspension plus stablecoin issuer freezes have helped limit further movement of stolen assets.

“"국내 거래소나 국내 투자자가 직접 피해를 입은 사실은 아직 확인되지 않았다" "바이낸스의 신속한 입출금 중단과 테더·서클 등 스테이블코인 발행사들의 자산 동결 조치가 탈취 자산의 추가 이동을 제한하는 데 기여하고 있다"” ko

Issued a notice warning users to be careful when withdrawing to Binance and said it could restrict withdrawals to Binance if needed to protect users.

Says the estimated total impact is around $6.3 billion, that about $3 billion has been frozen to contain losses, and that it will compensate all losses.

Says the bulk of the stolen funds were moved within 20 minutes and links the breach with high confidence to North Korea’s TraderTraitor group.

Says attackers may have accessed internal infrastructure through a compromised engineer’s laptop, suspended deposits and withdrawals, froze about $3bn with partners, and promised full compensation from its own capital and SAFU.

Says a compromise of a third-party service caused the theft of about $2.7m from user accounts; it suspended trading and promised compensation before resuming operations.

Reports the theft of roughly $5.7bn–$6.3bn, suspends deposits and withdrawals, freezes about $3bn with Tether and Circle, and says its initial investigation points to a hacked senior DevOps engineer’s laptop and unauthorised transfers while private keys remained safe.

Says customer funds are safe and that Binance will provide 100% compensation using its emergency security fund and balance sheet.

Suffered a cyberattack in which at least $2.7m was stolen through a vulnerability in third-party site-monitoring system Debagbear, suspended trading for an hour and promised compensation.

Cooperated with Binance to freeze about $3bn of stolen crypto assets.

Estimated unauthorised withdrawal transactions of about $6.3bn and said it would cover all losses through SAFU and company funds.

Says Binance has reserved more than $6.34bn to cover all hacked losses from company funds, that only its own hot wallet was affected and customer funds are safe, and that the complex attack used a self-destruct mechanism and EIP-7702 delegation to bypass normal approval controls.

“"We are committed to covering all hacked losses through our company funds. Your assets are safe."”

Says North Korean hackers were behind the roughly $6bn crypto hack.

Confirms a cyberattack possibly affecting $6.3bn, suspends deposits and withdrawals, says about $3bn has been frozen, and says its initial probe points to a hacked DevOps engineer’s laptop enabling unauthorised withdrawal transactions without private-key leakage.

Says customer funds are safe and expresses hope that as a shareholder he can ensure customer money is fully protected.

Says more than $150m in assets linked to the Binance hack have been frozen.

Says Circle froze more than $80m in coordination with law enforcement.

Says it is aware of the case and working with public and private partners to grasp the scope, assess impacts and coordinate investigative steps.

Did not respond to a request for comment sent outside US business hours.

Confirms a massive cyberattack, says it is freezing stolen assets and will cover all losses, and reports that its preliminary investigation pointed to a compromised laptop while follow-up findings revealed additional breach points.

“« Notre enquête préliminaire sur cet incident pointait vers un ordinateur portable dont la sécurité a été affectée. Cependant, nos investigations suivantes ont révélé des points de brèche supplémentaires »” fr

Says blockchain allows transactions to be tracked mechanically and that there are strong suspicions about a North Korea-linked group called Trade Traders, but no official confirmation yet.

“"L'avantage de cette technologie, c'est qu'on peut suivre les transactions de manière vraiment mécanique. Il y a pas mal de suspicions vers un groupe qui s'appelle Trade Traders, qui est un groupe lié à la Corée du Nord. Pour le moment, ce serait que de très fortes présomptions, mais pas de confirmation officielle."” fr

Says Binance engaged law enforcement and blockchain-analysis partners to trace and return funds and is working closely with them to identify and hold the criminals accountable.

“Мы тесно взаимодействуем с правоохранительными органами, чтобы установить личности этих преступников и привлечь их к ответственности” ru

Reports that North Korean hackers were behind the attack, moved most of the stolen cryptocurrencies within 20 minutes and tried to pre-empt freezing; says it is the largest attack on a crypto exchange, exceeding the $1.5bn Bybit hack.

Says roughly $6.3bn in assets were affected, deposit and withdrawal services were temporarily stopped, user holdings are safe, about $3bn has been frozen with partners, and all losses will be covered from company funds and a security fund; initial findings point to a compromised IT employee laptop and possible unauthorised payout orders without private-key theft.

Says the attack took just over a quarter of an hour across eight blockchains, that Binance wallets on at least ten chains were emptied into attacker-controlled addresses, and that the code was tested on wallets hours before being deployed on a Binance hot wallet.

“„Október 29-én kora reggel a szolgáltató telepítette a támadáshoz szükséges első kódrészletet, és két tárcán tesztelte. Később ugyanazon a napon egy harmadik tárcán gyakorolta a végleges verziót, majd a tesztpénzt visszairányította magához. Négy órával a próba után ugyanazt a kódot telepítették egy Binance forró tárcára”” hu

Reported a security incident affecting $6.3bn, suspended all deposits and withdrawals while investigating, said it froze more than $3bn, and has not confirmed the North Korean link but promised a detailed technical analysis after investigations.

“„Elővigyázatosságból átmenetileg felfüggesztünk minden befizetést és kifizetést, miközben biztonsági csoportjaink a bűnüldöző szervekkel és iparági partnereinkkel szorosan együttműködve ellenőrzéseket végeznek, biztosítják a tárcainfrastruktúrát, és felkutatják az érintett eszközöket”” hu

Describes the attack as extraordinary in scale and reaction, says few financial systems have suffered such a theft, and argues that North Korean theft finances weapons and destabilising activities, making it a global security issue rather than only a crypto theft.

“„Ez rendkívüli hekkertámadás, mind a méretét, mind a kiváltott reakciót tekintve. Kevés pénzügyi rendszernél fordult elő korábban ilyen mértékű lopás. Az eset rávilágít arra, mennyire ki van téve a rendszer az olyan kifinomult támadóknak, akik eddig sosem látott sebességűek.”” hu

Research indicates Binance detected money-laundering patterns not seen before, with thousands of rapid transactions suggesting automated tools to hide money movements.

Says Binance is one of the largest centralized exchanges, so a blow to confidence in it could undermine many retail investors’ confidence and push crypto asset prices down.

“„A Binance az egyik legnagyobb centralizált tőzsde, így a belé vetett bizalom megrendülése sok lakossági befektető bizalmát is megingathatja, ami visszavetheti a kriptoeszközök árfolyamát”” hu

Says defending against hacks is getting harder because AI finds vulnerabilities faster than they can be fixed, and users will move away from smaller and medium-sized exchanges that cannot cover major hack losses.

“„Egyre nehezebb védekezni a hekkertámadások ellen, mivel a mesterséges intelligencia gyorsabban találja meg a sebezhetőségeket, mint ahogy azokat ki lehetne javítani. Véleményem szerint a felhasználók el fognak pártolni a kisebb és közepes méretű tőzsdéktől, mivel túl kockázatos lesz olyan helyen tartani a pénzt, ami nem lenne képes fedezni egy jelentősebb mértékű hekkertámadás okozta kárt”” hu

Thanked crypto issuers for freezing assets and said security comes first, with withdrawals suspended until the environment is confirmed safe.

“„A biztonság az első: a kifizetések jelenleg szünetelnek, amíg meg nem bizonyosodunk arról, hogy a környezet biztonságos”” hu

Says the hack could further reduce risk appetite and prompt investors to review the safety of assets held on centralized exchanges and risks around counterparty, solvency and liquidity.

“„Ez tovább csökkentheti a kockázatvállalási kedvet, és arra ösztönözheti a befektetőket, hogy felülvizsgálják a centralizált tőzsdéken tartott eszközök biztonságát, valamint a partnerkockázattal, a fizetőképességgel és a likviditással kapcsolatos kockázatokat”” hu

Reported that it took steps with partners to freeze stolen funds.

Says the remaining $3.3bn is mostly bitcoin, ether and XRP that no one can freeze, and movement can be stopped only when funds reach an exchange or service; some seizure may occur in coming months but the frozen share is unlikely to grow significantly.

“„A fennmaradó 3,3 milliárd dollár nagyrészt bitcoinból, etherből és XRP-ből áll, amiket senki sem tud zárolni. A mozgásuknak csak akkor lehet gátat szabni, ha elérnek egy tőzsdét vagy más szolgáltatót. A következő hónapokban még sikerülhet lefoglalni az összegek egy részét, de nem számítok arra, hogy a zárolt hányad jelentősen tovább növekedne”” hu

Announced that together they froze $2.4bn in assets.

Says the attackers are masters at penetrating distributed financial organisations and that TraderTraitor appears focused on large-volume operations, previously developing fake applications to gain entry.

“„Ezek az emberek valóságos művészei annak, hogyan férkőzzenek be az elosztott pénzügyi szervezetekbe”” hu

Says the attack’s preparations and methods match techniques used by North Korean hacking groups.

Says coordinated industry action helps prevent movement of stolen funds.

Says all deposits and withdrawals are temporarily suspended as a precaution while security teams check infrastructure and trace assets.

““As a precaution, all deposits and withdrawals are temporarily suspended while our security teams conduct checks, secure wallet infrastructure and trace affected assets, with the close support of our law enforcement and industry partners.””

Says user money is safe and Binance is covering every loss, with $6.34bn set aside to cover stolen assets.

““Bottom line – your money is safe, and we’re covering every loss.””

Says user funds are safe and the incident does look like a hack, adding that as a shareholder he expects all user funds to be fully covered.

““User funds are safe!””

Says the breach may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralized exchanges.

““It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges,””

Says it froze nearly $1.57bn in assets linked to the incident.

Froze more than $800m linked to the hack.

Says it worked with custodian BitGo to freeze funds stolen in the Binance hack.

Says the Binance theft is almost certainly the largest theft of any kind in history.

““This is almost certainly the largest theft of any kind in history,””

Says the FCA is aware of the reported incident and engaging with Binance to understand the impact, though Binance was not registered to provide crypto services in the UK.

““While Binance wasn’t registered with the FCA to provide crypto services in the UK, we’re aware of the reported incident and engaging with them to understand the impact.””

Is monitoring the hack for potential fallout but is understood to have no active concerns.

Says it was unaffected and is monitoring the situation.

Says it was not affected by the security incident.

Says user funds are safe, calls it a hack on Binance, credits Tether and Circle freezes, and expects all user funds to be fully covered.

“User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”

Issued a note restricting new futures positions after the Binance incident came to light.

Says the response to the hack will be critical and attention will turn to how commitments are delivered and how transparently.

“The response will be critical ... attention will now turn to how that commitment is delivered, the safe restoration of services and the transparency of its disclosures.”

Says the first question after such an incident is access to funds, and a frozen venue means trapped capital for desks and uncertainty for customers.

“For a desk, a frozen venue means trapped capital and positions it can't manage. For a customer, it's simply not knowing when they'll get their money back.”

Says institutions may become more selective about custody arrangements, counterparty risk and how much capital they keep on exchanges.

Says the lasting effects will be closer scrutiny of how exchanges hold reserves, handle custody and keep operations running.

Says it is engaging closely with Binance and monitoring the incident.

Assesses that attackers compromised the signing infrastructure Binance uses to authorize transactions and issued instructions to move wallet assets, mostly within about 20 minutes.

Says this was a complex attack not carried out by one person, that a compromised laptop was an early lead with other breach points later found, and that a self-destruct mechanism erased tools and traces.

Says it has high confidence that North Korean group TraderTraitor carried out the Binance theft across 10 blockchains, mostly within 20 minutes, after at least 36 hours of preparation; about $2.7 billion was frozen but hackers still control roughly $2.4 billion in Bitcoin and Ethereum.

Attributed the February 2025 Bybit theft of $1.5 billion to TraderTraitor.

Have said North Korea relies on networks of nationals abroad and foreign facilitators in China, Russia, Cambodia, and Vietnam to launder stolen digital assets into fiat for procurement and weapons of mass destruction programs.

Says North Korea is behind the attack and calls it the largest cryptocurrency theft ever.

Says the estimated damage is about $6.3 billion, that about $3 billion has been frozen, and that all deposits and withdrawals are suspended with full customer compensation pledged.