Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets.
The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.
Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million USDC related to the incident, respectively. The Arbitrum Security Council is said to have executed a transaction to freeze about $30.5 million from the Binance Exploit.
"Initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said in an update.
The company said there is no evidence of a wallet private key leak, adding it will cover all losses from the Secure Asset Fund for Users (SAFU) fund and its own funds.
Out of an abundance of caution, Binance has also taken the following steps -
- Temporarily suspended deposits and withdrawals while security checks are completed
- Revoked the affected address authorization;
- Engaged law enforcement and blockchain intelligence partners to trace and recover funds
"We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice," Binance said.
In an update, Binance said it expects withdrawals to resume in 48 hours, after its team "completes a security revamp of the withdrawal service and its related addresses."
The development makes it the biggest cryptocurrency heist recorded to date, surpassing the theft of about $1.5 billion from Bybit in February 2025. The incident was subsequently attributed to North Korea.
"Our current estimate on the amount stolen is approximately $5.912 billion at time of theft, nearly 4x the amount stolen in the next largest crypto heist," blockchain intelligence firm Chainalysis said in an X post.
Attributed to North Korea's TraderTraitor
TRM Labs has attributed the record-breaking hack targeting Binance to threat actors from North Korea with high confidence. The blockchain analytics company linked it to TraderTraitor, which was also behind the 2025 Bybit heist, based on what it said were "robust on and off-chain intelligence sources."
"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst," TRM Labs said.
"The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit."
TRM Labs said preparation for the attack was underway at least 36 hours before the theft, with the attackers taking over a Binance hot wallet to send its "entire balance to an attacker-controlled address" -
At 20:20 UTC, the operator submitted a single transaction containing 50 authorizations. Each was signed by the Binance hot wallet, and each pointed it to a sweeper contract that accepts instructions only from the operator. Every wallet keeps a running count of its transactions, called a nonce, and an authorization works only at the count the wallet has reached at the moment it executes. The Binance hot wallet processes a steady flow of withdrawals, so its count keeps moving forward. By preparing signatures for 50 consecutive counts, the attacker guaranteed that one would still be valid when the transaction executed. One matched, which was all the attacker needed. The signatures were produced in advance as a batch.
Three minutes and 24 seconds after the delegation, the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains. The batch of 50 pre-signed authorizations suggests the access may have been limited in time, or that signatures had to be requested through a system. Binance has yet to publish a root cause.
Chainalysis has also linked the hack to the Democratic People's Republic of Korea (DPRK) with a high degree of confidence, stating it "observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance."
"The ability to quickly identify and understand illicit activity is increasingly important as North Korea increasingly uses sophisticated automation to move and obscure stolen funds," the company noted earlier this month. "Investigators must keep pace with these tactics while applying the judgment and expertise needed to make sense of complex on-chain activity."
So far, Tether, Circle, Ripple, and World Liberty Financial have frozen about $2.67 billion in stablecoins, and Arbitrum's Security Council has frozen about $30 million in ETH and ARB. The attacker continues to retain control of more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, plus smaller amounts on other chains.
Elliptic's chief scientist and founder, Dr. Tom Robinson, told The Hacker News cryptocurrency assets with a total value of $6.43 billion were stolen from Binance, assessing North Korea-linked actors perpetrated the theft, citing similar tradecraft and co-mingling of funds from another hack attributed to them.
"Rather than stealing Binance's private keys, the attacker appears to have been able to get Binance's own systems to sign transactions on their behalf," Elliptic said.
"This closely resembles the Bybit theft, in which North Korean hackers compromised a developer's machine at the wallet provider Safe{Wallet} and manipulated the transaction that Bybit's signers approved. In both cases, it was the infrastructure and people around the wallets that were compromised, not the cryptography."
The company also noted that 2.84 billion of funds have been frozen, while the attacker is in control of around $3.33 billion of assets that cannot be frozen by an issuer and are spread across about 43 wallet addresses. This includes 511,861 ETH (1.15 billion), 18,270 BTC ($1.43 billion), 233 million XRP, and 670 million TRX.
The links to North Korea are based on the following factors -
- Funds stolen from Binance and funds linked to the Bitget exploit have been sent to the same Ethereum address, 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7.
- Attackers funded their wallet with three small Tornado Cash withdrawals, tested the attack code in advance, and executed pre-signed transactions in a single burst, similar to what was observed in Bybit and KelpDAO exploits.
- The likely use of social engineering to trick employees into executing malware under the pretext of a coding test or a bogus project, a technique employed in DMM Bitcoin and Bybit hacks.
Despite these commonalities, Elliptic has urged caution in attributing the activity to North Korea, citing deviations from previously observed laundering patterns in terms of speed and methodology, as well as the absence of a root cause.
"DPRK launderers typically swap stolen stablecoins for native assets within minutes," Robinson said. "The attacker held the stolen USDT for 37 minutes on Ethereum and 46 minutes on Tron without converting most of it. North Korean-linked groups typically move funds faster and more efficiently. The use of market makers and DeFi lending protocols differs from the bridge-heavy laundering seen after the Bybit hack."
"Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop," Binance co-CEO Richard Teng said. "That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions."
"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual."
The company has since revealed that its ongoing investigation has "uncovered additional points of breach" that goes beyond the compromised laptop, and that it's "doing all we can in coordination with law enforcement to resolve it."
