Binance has put a number on the worst night in its history: about $6.3 billion. In a late-Thursday update, the world’s largest cryptocurrency exchange said that was the estimated total impact of the security breach that forced it to suspend all deposits and withdrawals — and that about $3 billion of the stolen assets had already been frozen with the help of blockchain partners.
“The estimated total impact sits at around $6.3B,” Binance said. “We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.” The company repeated its pledge: “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.”
The figures transform a story that was still foggy hours earlier. When Binance first halted transactions, it had confirmed $2.54 billion frozen but would not say how much had actually been taken, and its own statements stopped short of calling the incident a hack. Now the exchange has given its own estimate, and independent trackers have largely converged on it: blockchain intelligence firm TRM Labs traced about $6.36 billion moved out of Binance wallets, while Chainalysis said it had confirmed at least $5.912 billion stolen. The gap is a counting problem, not a contradiction: frozen coins and coins still moving across ten blockchains are hard to tally in real time.
Binance also offered a first explanation of how the attacker got in. Its initial investigation suggests the breach “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” The company said it had found no evidence that wallet private keys leaked, and promised a detailed technical post-mortem once the investigation is complete. TRM’s reconstruction fills in the mechanics: the attacker used a feature of the Ethereum network called EIP-7702 delegation to turn a Binance hot wallet into a sweeper under their control, with 50 pre-signed authorisations prepared in advance, and moved most of the money in about 20 minutes starting at 20:05 UTC on Thursday.
Then came the attribution — the part of the story with the widest consequences. TRM said it attributes the attack to TraderTraitor, North Korea’s elite hacking unit, “based on robust on and off-chain intelligence,” adding: “We make this judgment with high confidence.” TraderTraitor is a subunit of the Lazarus Group, the state-linked hacking organisation the FBI named as responsible for the $1.5 billion Bybit theft in February 2025. Security firm Blockaid said the tactics and sophistication seen so far are consistent with North Korean operations. That is an investigators’ assessment, not yet an official government finding, and one person familiar with crypto investigations cautioned it was not definitively established.
What is not in doubt is how much remains at large. If $3 billion is frozen, roughly $3.3 billion is not accounted for in Binance’s update. The freeze itself was an industry-wide effort: stablecoin issuer Tether froze nearly $1.57 billion in USDT, Circle froze more than $800 million in USDC, and Ripple froze around $200 million. Binance said it had revoked the affected address authorisation and engaged law enforcement to trace the rest. Co-founder Yi He said withdrawals would resume once the security scan is complete.
Markets took the news badly. Bitcoin fell to a six-week low, last down about 3% at $76,470, while ether dropped more than 3% to $2,186. Shares in rival exchange Coinbase slid 4.8% and bitcoin buyer Strategy fell nearly 6% in extended trading. “It’s the biggest hack in history,” said Aravind Srinivasan of market maker GSR, noting that bid-ask spreads on spot bitcoin on Binance had run five times wider than normal.
Why this matters reaches beyond one exchange’s balance sheet. Binance handles more trading than any rival, holds about $162.8 billion in assets under custody, and counts 335 million registered users. A breach at that scale tests two promises at once: that customer funds are backed one-to-one, and that the industry’s emergency machinery can claw money back when its biggest player is the victim. Binance has promised an updated proof of reserves once remediation is complete; that document, and the date withdrawals reopen, will tell users more than any pledge. The earlier suspension is covered in our first report on the Binance hack.
The timing compounds the damage. The hack landed in the middle of a brutal week for risk assets — Alphabet lost $500 billion in market value in a single day — and, if the North Korea attribution holds, it would mean a sanctioned state’s hackers have now pulled off the two largest crypto thefts on record within twenty months, each time against an exchange that was supposed to be too big to rob. If Binance’s controls could be beaten through one engineer’s laptop, regulators will ask whose controls are safe.
