Binance Says a $6.3 Billion Hack Hit Its Wallets and Promises to Cover Losses
The world's biggest exchange paused withdrawals Thursday after attackers drained hot wallets. About $3 billion is frozen, and Binance says its own funds will make users whole.
Binance, the world's largest crypto exchange, says attackers pulled about $6.3 billion in crypto from its wallets on Thursday afternoon. It froze withdrawals, and it says users won't eat the loss. In its security incident update, Binance says losses will be covered "from the SAFU fund and the company's funds." It also says about $3 billion has already been frozen on-chain with help from partners. If the figure holds, it's the biggest crypto theft on record. BBC News notes it eclipses the $1.5 billion Bybit hack in 2025, the previous record.
Binance's first detailed explanation came a little after 9:20 p.m. CT:
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
About 3:20 p.m. Funds start leaving Binance hot wallets on several blockchains, according to Chainalysis. Hot wallets are the online wallets an exchange uses to process withdrawals.
About 4:14 p.m. Freezes begin, Chainalysis says. Tether CEO Paolo Ardoino posts that Tether froze more than 1.567 billion USDT minutes later.
5:33 p.m. Binance says it has paused withdrawals for security checks.
7:13 p.m. Binance says it "will cover all losses" and suspends all deposits and withdrawals.
9:25 p.m. Binance posts its initial findings, a roughly $6.3 billion impact and about $3 billion frozen.
11:31 p.m. Chainalysis says it has "a high degree of confidence" that North Korea is behind it.
11:36 p.m. Binance reopens deposits. Withdrawals stay paused, with a target of resuming within 48 hours.
Tether froze more than 1.567B USDT related to a potential Binance exchange hack.
Protecting the industry and our partners is our main priority.
Binance's first read is that a DevOps engineer's laptop was compromised. That gave the attacker access to a "service container." From there, the attacker submitted withdrawal transactions that looked authorized. Binance says it has "found no evidence of any wallet private key leak." In other words, the vault keys weren't stolen. The systems allowed to use them were.
The story shifted overnight. Early Friday, Binance said its "subsequent investigation has uncovered additional points of breach," so the laptop was not the whole picture. Co-CEO Richard Teng said the attack "was not a single 'one-click' action" and that no individual has been blamed.
Fueled Crypto Daily
Get the news, explained, by email.
Teng gave more detail in a video update Friday morning. He said the attacker used EIP-7702, an Ethereum feature that lets a wallet hand control to outside code, to "obtain on-chain execution approval over a hot wallet." That approval "did not pass through our normal approval controls." He also said the attacker used "a self-destruct mechanism" that wiped tools and traces along the way. Chainalysis describes the same basic move on Ethereum: signed authorizations that let a Binance hot wallet run the attacker's code. Binance has promised a full technical post-mortem once the investigation is done.
Where the money is now
Binance says about $3 billion is frozen. Chainalysis's own count is about $2.8 billion frozen, from a theft it puts at roughly $6.4 billion. The difference is likely timing and pricing, but nobody has reconciled it yet.
Stablecoins are why so much could be frozen. Issuers like Tether and Circle can block their tokens at specific addresses. Bitcoin and ether can't be frozen that way. Chainalysis says the attacker raced to swap about $325 million in stablecoins into ether before the freezes landed. Binance co-CEO Yi He thanked Tether, Circle, World Liberty Financial and the Arbitrum Security Council for freezes. CNBC reports Ripple also froze RLUSD tied to the attack. Yi He thanked Ripple on X for "freezing approximately 200 million." That figure is hers. We couldn't find a total from Ripple itself.
Binance says it has also begun recovering assets for users. It says that's separate from the frozen funds, which still have to be recovered and verified. To fill the rest of the gap, Binance says it's buying the stolen tokens back on the market and through OTC desks. Some are thinly traded, so that step may take time.
Chainalysis also says stolen funds were mixed at the same address with money taken in September's Bitget hack, which was already linked to North Korea's TraderTraitor group:
Our investigators observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance.
We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance. https://t.co/xj9dQYcbKr
Withdrawals. Still paused as of Friday morning. Teng said Friday he's "very hopeful" they return before Binance's Sunday deadline, which he put at within about 40 hours.
Deposits. Working again since late Thursday.
Your balance. Binance says user funds are safe and that it has set aside more than $6.34 billion of company money. About $5 billion of that is already in the exact tokens that were taken. Teng says the stolen funds came from Binance's own hot wallet, and most customer assets sit in cold storage.
Proof of reserves. Binance is targeting Monday for its first public proof of reserves since the hack. It hopes to share an early look before then.
Binance.US. It's a separate platform, and it told the BBC it isn't affected.
Expect phishing. Big hacks bring fake "refund" and "verify your account" messages. Binance says it will post updates only through its official channels. Our guide on spotting crypto scams covers the usual tricks. Our exchange vs. self-custody explainer covers the trade-off this story raises.
What we don't know yet
There's no final loss figure, no post-mortem, and no firm restart time for withdrawals. North Korea attribution comes from blockchain analytics firms, not law enforcement. Chainalysis and TRM Labs both point to North Korean hackers. The FBI told CNBC it's aware of the incident and is working with partners. It hasn't named a suspect. Binance says it's working with police to "confirm the identity of these criminals." Bitcoin slid more than 4% to just under $78,000 on Friday, per CNBC.
The French bank says attackers used its own account, not customer accounts. It validates the order of magnitude of reported losses, not a final figure.
The exchange's first incident report describes a months-long campaign. It ran through a tampered download, a rigged coding assignment and an abused internal AI tool.
