The world’s largest cryptocurrency exchange suffered the biggest heist in crypto history, forcing a temporary halt to withdrawals and sending Bitcoin tumbling as investigators point to the Lazarus Group.
Binance has confirmed that a massive security breach resulted in an estimated $6.3 billion in losses, marking the largest cryptocurrency hack ever recorded and eclipsing the previous record by a factor of four.
The exchange announced on Thursday that it had frozen approximately $3 billion of the affected assets on-chain, but acknowledged that a significant portion of the funds remains unaccounted for.
The attack, which unfolded over a matter of minutes rather than hours, targeted Binance wallets across at least ten different blockchains.
Blockchain analytics firms TRM Labs and Chainalysis have both attributed the attack with high confidence to TraderTraitor, a hacking collective widely believed to be an arm of North Korea’s Lazarus Group.
Preliminary investigations by Binance suggest that the attackers did not compromise wallet private keys, a critical detail that distinguishes this breach from conventional crypto thefts. Instead, the exploit appears to have originated from a compromised laptop belonging to a DevOps engineer.
According to the exchange, the attacker used this access to reach a “service container” capable of initiating withdrawal transactions, effectively bypassing the cryptographic safeguards that protect user funds.
Cyber security experts described the method as a fundamental shift in attack strategy.
“The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign,” said Jayant Dave of Check Point, speaking to the BBC. “That’s the lesson: a strong vault doesn’t matter if someone controls the process that opens it.”
Emily Taylor, co-founder of the Global Signal Exchange, noted that the speed and scale of the operation were unprecedented.
“It also highlights very much our dependence on technology,” she told BBC Radio 4. She added that state-sponsored actors frequently target engineers with fake job advertisements to compromise their machines, a technique that appears consistent with the early findings.
Binance has moved swiftly to reassure users, stating that all deposits remain unaffected and that withdrawals would resume within 45 hours. The exchange confirmed that user funds are safe and that all losses would be covered by the Secure Asset Fund for Users (SAFU) and company reserves.
Former CEO Changpeng Zhao, who no longer manages the exchange but remains a major shareholder, provided a blunt assessment of the financial gap on X. “Rough math: $6.x b hack, $3b frozen, $1.x b SAFU fund. Gap is about $2b,” he wrote. “We have $1.x billion in SPCX alone. Remaining gap is (still painful, but) manageable.”
Zhao was referring to Binance’s holdings of SpaceX shares, reportedly acquired through a $500 million investment in Elon Musk’s Twitter takeover.
Current CEO Richard Teng emphasized that the attack involved “more complex attack steps” than a single compromised engineer’s credentials, and confirmed that no evidence of private key leakage had been found.
The crypto market reacted sharply to the news. Bitcoin fell approximately 5% to around $76,400, its lowest level in a month, while Ether, Solana, and XRP also suffered declines. The panic triggered roughly $600 million in long liquidations within minutes of the initial reports.
In a striking demonstration of the role centralized stablecoin issuers play in the ecosystem, Tether and Circle moved rapidly to freeze funds linked to the attacker’s addresses. Tether froze approximately $971 million in USDT, while Circle froze roughly $823 million in USDC, collectively limiting the damage. The freezes were cited by Zhao as a critical factor in containing the fallout.
The Binance breach dwarfs the previous record, a $1.5 billion theft from the Bybit exchange in February 2025, which was also attributed to TraderTraitor. On-chain detective ZachXBT later reported that funds from the Binance hack and a separate $388 million breach at Bitget were mixed at the same address, suggesting the two incidents may share a common perpetrator.
For North Korea, cyber theft has become a vital revenue stream for a regime crippled by international sanctions. The Lazarus Group has been linked to a long string of crypto heists, and the wealth of evidence from blockchain flow analysis has made the attribution increasingly difficult for Pyongyang to deny.
