Binance, the world’s largest cryptocurrency exchange, has confirmed a staggering security breach resulting in the theft of approximately $6.3 billion. This incident marks the largest digital currency heist in history, significantly surpassing the previous record of $1.5 billion stolen from Bybit in February 2025. In December 2022, South Korea’s spy agency estimated that North Korean hackers had stolen about 1.5 trillion won ($1.1bn) in crypto and other virtual assets over five years. Analysts told Reuters, the hack comes as crypto had already been under pressure from higher US interest rates and weaker demand from exchange-traded fund buyers. The Secure Asset Fund for Users, set up in 2018 and held entirely in Bitcoin to protect users in case of a breach, the stolen sum is more than six times Binance’s $1bn emergency fund. Is crypto an inherently unsafe investment.
The breach occurred late Thursday, with attackers moving funds across 10 different blockchains over a span of about 20 minutes. According to blockchain analysis firms TRM Labs and Chainalysis, the total volume of stolen assets reached $6.36 billion. Binance has confirmed that roughly $3 billion of these funds have been frozen, including $2.3 billion secured by stablecoin issuers Tether and Circle, but the location of the remaining $3.3 billion remains unknown. However, chainalysis reached the same conclusion.
Company co-CEO Richard Teng stated that Binance is working to trace additional assets, warning that the total theft figure may continue to rise. While the exchange initially suspected a single compromised laptop belonging to an engineer, further investigation revealed multiple points of entry. Binance denies that any private keys—the essential security codes for digital wallets—were leaked during the attack.
Industry experts, including former Mt Gox head Mark Karpeles, have suggested that attackers likely gained access to keys for at least two major wallets. Despite these challenges, Binance has reassured users that their funds are safe and has committed to covering all losses using company reserves. The exchange suspended deposits and withdrawals on Thursday and remains focused on resuming normal operations within 45 hours.
Analysts at TRM Labs have expressed high confidence that the assault was orchestrated by TraderTraitor, a North Korean hacking unit affiliated with the Lazarus Group.
This group is widely recognized by the Council on Foreign Relations and the US Treasury Department for conducting cyber operations to generate illicit revenue for the North Korean regime. The Lazarus Group “targets and compromises entities primarily in South Korea and South Korean interests for espionage, disruption, and destruction”, according to the Council on Foreign Relations (CFR). Saying it was controlled by North Korea’s primary intelligence bureau, the US Department of the Treasury sanctioned the Lazarus Group in 2019.
These funds are reportedly used to support Pyongyang’s nuclear weapons program and bypass international sanctions.
The scale of this theft has sent ripples through global financial markets. Following the announcement, Bitcoin dropped to a six-week low of $76,368, while Ether prices declined by more than 3 percent to $2,178. Shares of the exchange Coinbase also fell 4.8 percent. Experts note that this event highlights the inherent risks of centralized crypto exchanges, which serve as massive honey pots for sophisticated state-backed actors. And what does it mean for the crypto market, so how did it happen. Though markets steadied after the initial shock, prices have fallen.
Sean Foley, an expert in crypto markets at Macquarie University, observed that as these exchanges grow their holdings, they inevitably become more attractive targets. Insurance coverage for such events remains sparse, as most standard cyber-insurance policies do not extend to cryptocurrency assets. The frequency of such attacks is high; in 2025 alone, hackers successfully stole $2.87 billion across nearly 150 incidents. Centralised exchanges, which hold users’ assets on their behalf, the hack has exposed one particular weak point: Large. According to TRM’s 2026 Crypto Crime Report, hackers stole $2.87bn in crypto in nearly 150 attacks in 2025. And crypto-specific cover remains a niche business offered largely by specialist insurers, insurance offers limited protection as most crime- and cyber-insurance policies do not cover stolen cryptocurrency.
This incident adds to the regulatory and legal challenges Binance has faced in recent years.
The company’s founder, Changpeng Zhao, previously pleaded guilty in 2023 to felony charges related to anti-money laundering failures, eventually receiving a pardon from US President Donald Trump in 2025.
As of Friday, Binance officials indicated they are actively coordinating with law enforcement agencies to investigate the source of the breach and recover the missing funds.
