Binance halts transfers after reported $6.3 billion cryptocurrency theft
Binance, the world’s largest cryptocurrency exchange, has suspended deposits and withdrawals while it investigates a reported theft of at least $6.3 billion from its wallets. Security researchers at TRM Labs and blockchain security firm Elliptic attributed the incident to North Korean hackers, while TRM Labs described it as the largest cryptocurrency hack on record.
Roughly half of the stolen cryptocurrency was frozen as it moved across different blockchains, researchers said. The final amount may still change, and the incident has not been confirmed as resolved. Binance said user funds are safe, but it did not immediately provide evidence for that claim.
Compromised employee laptop cited in initial investigation
Binance said its initial investigation indicated that attackers entered its network after targeting a compromised laptop belonging to a Binance engineer. The access allegedly allowed an attacker to reach a service container and submit unauthorised withdrawal transactions.
The exchange said it has found no evidence that its private keys were leaked. Such keys could give an attacker broad control over cryptocurrency holdings. Binance said it will publish an updated proof of reserves after remediation is complete.
The company had already paused withdrawals on some blockchains, and its wider suspension of deposits and withdrawals will remain in place as the investigation continues. Binance did not immediately respond to questions about the breach, including whether an external security audit had been carried out before the incident.
Attribution points to a recurring North Korean threat
TRM Labs attributed the theft to a North Korean hacking network known in the cybersecurity industry as TraderTraitor. Researchers describe the group as focused almost entirely on stealing cryptocurrency from large companies and exchanges. The group was also blamed for the $1.4 billion theft from Bybit in 2025, previously the second-largest crypto heist on record.
Elliptic reached the same attribution and said that some stolen Binance funds landed in the wallet used in an earlier attack on Bitget, where hackers stole $351 million. TRM Labs estimated that the Binance theft took about 20 minutes.
The account of a compromised engineer device leaves key details unresolved, including how that laptop was compromised and what controls governed access to systems able to initiate withdrawals. Compromised software components, as well as malware embedded in seemingly legitimate applications or games, can steal credentials and session tokens that let intruders act as employees.
Access design becomes a business risk
The incident highlights the operational stakes of endpoint security where a single device can open a path toward systems handling high-value assets. Businesses responsible for customer funds should assess device protection, access segmentation, withdrawal approval paths and independent testing so that a compromised endpoint cannot by itself enable unauthorised transactions.