Crypto giant Binance hit by $6.3bn hack suspected to be largest in history

Cryptocurrency exchange Binance has been struck by a security incident impacting approximately $6.3bn (£4.7bn) in digital assets, marking what analysts and industry observers describe as potentially the largest crypto heist in human history according to LBC.

Initial investigations by the exchange indicate that the intrusion may have originated from a compromised laptop belonging to an engineer, which reportedly granted the attacker unauthorized access to internal systems to execute large-scale withdrawals. While Binance officially described the $6.3bn figure as "impacted" rather than definitively stolen, pointing out that many assets remained under review, co-founder and major shareholder Changpeng Zhao stated on social media that the event "does look like a hack on Binance". Zhao also noted that he expects all user funds to be fully covered by the platform.

Media additions

Blockchain intelligence and analytics firms have moved swiftly to assign responsibility for the incident. Both TRM Labs and Chainalysis stated they possess high confidence that the assault was orchestrated by TraderTraitor, an elite North Korean state-backed hacking unit tied to the Lazarus Group. Ari Redbord, global head of policy at TRM Labs, described the event as a watershed moment for the digital asset industry, warning that state-sponsored cryptocurrency theft of this magnitude directly supports weapons proliferation and destabilizing geopolitical activities. Western security agencies have previously cautioned that funds amassed through such cyberattacks are funneled into North Korea's nuclear and ballistic missile programs.

The scale of the breach far surpasses previous digital currency thefts, eclipsing the record-setting $1.5bn hack on the Bybit exchange that occurred in 2025. According to TRM Labs' crime reporting data, cybercriminals stole $2.87bn across nearly 150 separate incidents throughout 2025, making a single $6.3bn intrusion an unprecedented escalation in cyber threat severity.

In response to the emergency, several centralized cryptocurrency entities utilized administrative controls to halt the movement of stolen funds. Stablecoin issuer Tether froze approximately $1.6bn in assets, while Circle blocked more than $800m of its USDC tokens. World Liberty Financial, a crypto company linked to US President Donald Trump and his family, also said it has worked with its partners to freeze stolen funds. Yi He, Binance's co-chief executive, issued public statements thanking partner issuers for their rapid cooperation in locking down affected accounts.

Despite these collaborative freezing efforts, analysts caution that the threat is far from neutralized. Redbord noted that despite the immobilization of over $3bn in assets by industry partners, the attacker still controls approximately $2.4bn (£1.8bn) worth of unrecovered Bitcoin and Ether. Binance confirmed that all customer deposits and withdrawals remain temporarily disabled as security teams work to secure wallet infrastructure and trace the remaining funds.

The fallout extended rapidly beyond Binance's platform infrastructure. Bitcoin dropped by over four percent following the initial market alerts, falling below $77,000 to reach a six-week low of $76,368. Other major digital tokens, including Ethereum and Solana, suffered sharp declines. Equities tied to the cryptocurrency sector also absorbed heavy losses in extended trading sessions, with exchange Coinbase Global sliding nearly five percent and corporate bitcoin treasury buyer Strategy falling approximately six percent.

Industry observers warned that the incident risks severely dampening investor risk appetite and intensifying scrutiny over centralised exchange security. Sean Foley, a crypto market expert at Macquarie University, noted that large centralised trading hubs inherently represent high-value honeypots for sophisticated attackers, potentially driving retail traders toward decentralized alternatives. Bernardo Brites, chief executive of stablecoin infrastructure firm Trace Finance, observed that artificial intelligence tools are allowing threat actors to identify vulnerabilities faster than engineers can patch them, creating systemic challenges for platform security.

Market participants across various jurisdictions are monitoring the situation closely. Binance's smaller American affiliate, Binance.US, and rival exchange Coinbase both confirmed that their respective platforms remain entirely unaffected by the security breach.

As investigations continue, attention remains focused on official communications from the exchange. Binance has promised to release a comprehensive technical post-mortem report once security audits and law enforcement coordination conclude. Users and market participants have been strongly advised by company executives to rely solely on official corporate channels for updates, rather than unverified social media claims, as authorities work to trace the remaining billions and identify the individuals behind the historic heist.