Binance Hit by $6.3B Breach: How Hackers Pulled Off the Largest Crypto Theft in History

Short answer: Binance was hit by an unprecedented $6.3 billion hack, marking the largest cyber theft in financial history. While viral social media claims suggested a single worker clicked a bad link and gave away the keys to the kingdom, the actual attack was far more sophisticated. The hackers breached an engineer’s laptop, infiltrated an internal service container, and took control of the automated signing systems that authorize digital withdrawals. Investigators have not found any leak of private vault keys. Around half of the stolen funds were frozen through quick cooperation with stablecoin issuers, but billions remain in the hands of suspected North Korean state hackers.

1. What actually happened: Inside the $6.3 billion heist

On Thursday, the cryptocurrency world woke up to shocking news. Binance, the undisputed heavyweight of global crypto trading with over 300 million registered users, revealed that hackers had compromised $6.3 billion in customer digital assets.

To put that staggering number into perspective, this single theft dwarfs every previous cryptocurrency heist ever recorded:

• Bybit hack in 2025: Hackers stole $1.5 billion, which was the previous world record.
• Ronin Network bridge in 2022: Cyber criminals took $620 million from gaming accounts.
• Bitget breach in September 2026: Intruders walked away with $388 million.

The Binance breach is more than four times larger than the previous record.

At first, Binance suggested the issue started on a single remote workstation. The company stated that a DevOps engineer’s laptop had been compromised. That explanation led many traders to assume an employee fell for a basic phishing email.

A deeper investigation quickly revealed a much darker reality. Hackers did not just read files on a laptop. They used that initial foothold to hop into an internal service container deep inside the exchange network. From there, they found additional entry points and manipulated the automated system that signs off on customer withdrawals.

As Check Point chief information security officer Jayant Dave observed, modern attackers no longer waste time trying to crack cryptographic vault keys. Instead, they target the digital plumbing and the authorized software services that move the money.

2. Market shockwaves: Bitcoin slides as traders panic

News of the breach sent immediate chills across global financial markets. Because Binance holds more than $160 billion in customer assets, any sign of trouble at the exchange sparks instant fear.

Within hours of the alert, major digital currencies tumbled sharply:

• Bitcoin slid by more than 5 percent, dropping to $76,800 during New York trading hours.
• Ethereum and Solana experienced steep sell-offs as traders rushed to cash out.
• Shares of publicly traded exchanges also took a beating. Coinbase plunged 12 percent, while retail broker Robinhood dropped nearly 8 percent.

Binance co-chief executives Richard Teng and Yi He moved quickly to calm nerves. They announced that deposits remained unaffected, while withdrawals were temporarily disabled to isolate the intrusion.

The company also promised that user balances were completely safe and pledged to cover every dollar lost using corporate reserves. In an official update, Binance stated it had set aside over $6.34 billion in company funds and was actively buying tokens to plug the deficit.

Yet long-time crypto observers remain anxious. The promise that customer funds are fine echoed statements made by FTX founder Sam Bankman-Fried shortly before his exchange collapsed in 2022. Traders are watching forensic recovery efforts closely to verify whether Binance has the liquidity to survive the hit.

3. The suspects: Why all eyes point to North Korea

Within hours of the attack, leading blockchain intelligence firms identified the likely culprit. Both TRM Labs and Chainalysis reported high confidence that the heist was carried out by TraderTraitor, a specialized unit inside North Korea’s notorious Lazarus Group.

The evidence points to familiar digital footprints:

• Similar tactical playbooks: The methods used to pivot from a developer laptop to internal hot-wallet signing tools closely matched the 2025 Bybit heist and recent exchange attacks.
• Advanced laundering trails: Chainalysis researchers noted that the attackers moved stolen tokens using brand-new laundering techniques designed to bypass automated compliance filters.
• Digital self-destruct mechanisms: Binance confirmed the hackers wiped their tools and erased system logs as they worked, deliberately blinding forensic investigators.

Ari Redbord, global head of policy at TRM Labs, described the attack as a watershed moment for the entire cybersecurity sector. Unlike typical cyber gangs that demand ransoms, North Korea’s state-backed Lazarus Group operates under direct orders from Pyongyang to generate cash for weapons programs.

This attack serves as a wake-up call for internet security. Similar to recent incidents involving major financial cyberattacks and banking security vulnerabilities, technical complexity has outpaced traditional network defenses.

Sources to check yourself

• BBC News Technology Desk: Follow breaking coverage on the Binance breach and global market reactions.
• Chainalysis Research Portal: Review forensic on-chain transaction flows and exchange vulnerability reports.
• TRM Labs Intelligence Bulletins: Read technical breakdowns of Lazarus Group wallet infiltration tactics.
• Check Point Research: Inspect enterprise security advisories on compromised DevOps credentials and container security.

Frequently asked questions

Q: Were individual user passwords or private keys stolen? A: No. Binance confirmed that hackers did not steal private wallet keys. Instead, the attackers compromised internal software services and authorized automated withdrawals directly from exchange reserves.

Q: Did the hack affect Binance US customers? A: Binance stated that the incident was confined to its global platform, Binance.com. Its separately managed American arm, Binance.US, was not impacted.

Q: How much of the stolen money has been found? A: Approximately half of the stolen assets were quickly frozen with help from stablecoin operators like Tether and Circle. However, billions of dollars worth of digital tokens remain in the hands of the attackers.

Q: Will users lose their deposits? A: Binance leadership promised to cover all customer losses out of company funds. The exchange set aside $6.34 billion to replace stolen assets, but external recovery and full audits will take weeks.