Binance announced on Thursday that it has fallen victim to a large-scale cyberattack with a total estimated impact of approximately $6.3 billion, equivalent to roughly €5.6 billion. The exchange stated that around $3 billion of the compromised funds have already been frozen on the blockchain, a figure that may increase as tracing efforts continue in coordination with authorities and industry partners. If these figures are confirmed, the incident would represent an impact more than four times larger than the previous record set by the Bybit platform hack in February 2025, which involved $1.5 billion.
Initial investigations pointed to a compromised laptop belonging to a DevOps engineer, which allegedly allowed an unauthorized third party to access a "service container" and execute unauthorized withdrawals. However, a subsequent update from Binance described the incident as a complex attack involving additional points of security breach beyond the initial findings. The company emphasized that it is still gathering facts in coordination with law enforcement and has not yet officially identified any specific attacker.
Despite the severity of the breach, Binance assured users that their funds are safe, committing to cover all losses through its Secure Asset Fund for Users (SAFU) and company reserves. The exchange also noted that there is no evidence of private key leakage from wallets and promised to release a detailed technical analysis once investigations conclude. Regarding operational status, while deposits remain unaffected, withdrawals were suspended immediately after the attack was detected. Binance expects to resume withdrawal services within 45 to 48 hours, pending the completion of security checks.
In terms of asset recovery, blockchain intelligence firm TRM Labs expressed high confidence that the attack was orchestrated by TraderTraitor, a group linked to North Korea and believed to be part of the Lazarus Group, which the FBI previously identified as responsible for the Bybit case. Although Chainalysis also considers this attribution likely, Binance has not officially confirmed the perpetrator. Significant efforts have been made to freeze stolen assets; Tether CEO Paolo Ardoino reported that over $1.5 billion in USDT was frozen, while Circle froze more than $800 million in USDC. These stablecoins allow issuers to technically block funds, contributing to the roughly $3 billion currently immobilized.
The news triggered a market reaction where most cryptocurrencies depreciated, with the exception of stablecoins. By 4:00 AM on Friday, Bitcoin and Ether were down 0.8% after experiencing drops of nearly 5% and 6%, respectively. Conversely, Binance's native token, BNB, rose by 2.7% following an earlier decline of almost 10%. The exchange plans to publish an updated proof of reserves once the remediation work is finalized.
Sources: Pplware.