Binance has suspended all withdrawals after the world’s largest cryptocurrency exchange fell victim to what appears to be the biggest heist in history.
The exchange put the “estimated total impact” of the hack at about $6.3 billion and said around $3 billion of affected assets, mainly stablecoins that act as cash for the crypto market, had been frozen.
But analysts at Elliptic said the attacker had changed about $3.3 billion into digital assets that could not be frozen and was working to cash those out as traditional currency.
An “initial investigation” suggested hackers had been able to compromise an engineer’s laptop and withdraw funds from the platform, Binance said, adding on Friday morning that further investigation “has uncovered additional points of breach.” The company is working with law enforcement.
Blockchain intelligence firm TRM Labs linked the hack with a North Korean unit known as TraderTraitor, saying that the sums involved would make it “the largest crypto theft on record.” Last year, North Korean hackers stole crypto worth $1.5 billion in an attack on exchange Bybit.
Peter Ward, of the Sejong Institute in Seoul, said North Korea had considerable expertise and offered “near-total protection to its hackers.”
“Things may get a lot worse going forward,” he said.
Binance said on Friday that it had “already reserved over $6.34 billion of company funds to cover this incident,” with $5 billion of the funds “already held in the exact token assets that were impacted.”
The company said it was actively buying more tokens in order to cover the remaining amount. “This step can take longer because some tokens may have low liquidity,” and settlement “also takes time,” it said.
The hack is a major blow to Binance, which was co-founded in 2017 by Changpeng Zhao and holds about $140 billion of digital assets. In 2023, the company pleaded guilty to US criminal charges related to breach of anti-money laundering laws and paid a $4.3 billion fine.
Zhao, known as CZ, pleaded guilty to criminal charges relating to inadequate money laundering controls. He stepped down as chief executive and was pardoned last year by US President Donald Trump.
Bitcoin fell about 4 percent in the hours after the hack emerged late on Thursday before regaining ground to trade above $78,000.
The crypto market is in the grip of a prolonged downturn after a sharp sell-off late last year wiped more than $1tn from the combined capitalization of about 18,000 digital tokens.
Richard Teng, co-chief executive of Binance, told customers that their “money is safe, and we’re covering every loss” from a reserve fund as well as “company funds.” Binance’s reserve fund holds about $1 billion worth of bitcoin, according to a company update from mid-October.
Zhao said this leaves roughly $2 billion that the company still needs to cover, adding that the company owns shares in Elon Musk’s SpaceX worth more than $1 billion.
“Remaining gap is (still painful, but) manageable,” he said in a post on X.
Binance co-chief executive Yi He said on Friday that the company’s annual revenue “is sufficient to cover the losses,” without giving further details. CZ said earlier this year that the company’s annual revenue is about $5 billion.
Crypto venues have become lucrative targets for hackers, with notable heists including $280 million stolen in April from the coffers of unregulated crypto exchange Drift.
Unlike traditional exchanges, crypto venues sit on big piles of customer assets. Some institutional investors in recent years have sought third-party custody arrangements in order to keep their funds elsewhere and mitigate the risks of their assets being stolen directly off the exchange.
Binance works with Swiss banks Sygnum and Flow, the FT previously reported.
Abu Dhabi’s Financial Services Regulatory Authority, which regulates Binance’s main global crypto exchange, said in a statement on Friday that it was aware of the “security incident involving unauthorized withdrawals of assets” from the company’s exchange and was “engaging closely with Binance.”
Binance was ordered to wind down its EU operations in July after it failed to secure a license under the bloc’s new regulatory framework. The exchange, which became regulated in Abu Dhabi in December 2025, had already agreed to block UK customers from signing up for the exchange after being barred by Britain’s financial watchdog in 2021.
In the US, Binance operates under a separate entity from the rest of its global operations that is registered with the Financial Crimes Enforcement Network and authorized to operate as a money transmitter in 32 states.
Last month, nearly $390 million was stolen from crypto exchange Bitget, which reimbursed customers from its so-called User Protection Fund.
North Korean hackers stole about $2 billion in cryptocurrency in 2025, a 50 percent increase from the year before, according to data from Chainalysis.
Binance said it found no evidence that unique user codes, known as “private keys,” had been breached.
In a post on X early on Friday, Yi He said the exchange expected to allow withdrawals again “in the next 48 hours.”
Binance, which has no official headquarters, last year became regulated in Abu Dhabi, where Zhao and He, who are romantic partners, are based.
In a sign of the potential repercussions from the heist, Paolo Ardoino, chief executive of Tether, said his company had frozen about $1.5 billion of USDT, its $180 billion dollar-linked stablecoin.
Jeremy Allaire, head of Circle, the second-biggest stablecoin issuer, said $800 million of its USDC coin had been frozen amid “reports of a potential exploit” at Binance.
Crypto companies can freeze the wallets in which stolen funds are moved or held. Analytics firm Elliptic said it had verified $2.8 billion of frozen crypto—mostly USDT and USDC—but that the hackers had moved the remainder into assets that could not be frozen, such as the ETH crypto token.
“This is almost certainly the largest theft of any kind in history,” Elliptic said.
Additional reporting by Daniel Tudor in Seoul
Financial Times
Financial Times
Source: arstechnica.com
