Hackers have stolen an estimated $6.3 billion in crypto-currency from Binance, the world's largest crypto-currency exchange, in what blockchain intelligence firm TRM Labs describes as the biggest crypto theft on record.
According to a statement published by the crypto firm, the attackers targeted Binance wallets across 10 blockchains.
The incident surpasses the $1.5 billion Bybit hack in February 2025, which was previously considered the largest crypto-currency theft.
Binance says its initial investigation points to a possible compromise involving a DevOps engineer's laptop. The exchange says the attacker may have used access to a service container to submit unauthorised withdrawal transactions.
Binance further says it had found no evidence that wallet private keys had been leaked and would publish a detailed technical postmortem once its investigation was complete and the facts had been verified.
“Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
"Binance will cover all losses from the Secure Asset Fund for Users (SAFU) and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete," the company says.
SAFU is Binance's emergency insurance fund established to protect users in extreme circumstances.
The exchange says approximately $3 billion in affected crypto-currency had been frozen on-chain through collaboration with blockchain partners.
The exchange says it has temporarily suspended deposits and withdrawals while conducting security checks. It also revoked the affected address authorisation and enlisted law enforcement agencies and blockchain intelligence partners to trace and recover the assets.
North Korean hackers suspected
In a statement, blockchain intelligence and analytics company TRM Labs attributes the attack to TraderTraitor, a North Korean state-sponsored hacking group, based on what it describes as “high-confidence on-chain and off-chain intelligence”.
According to the firm, attackers moved funds from Binance wallets on networks including Ethereum, Bitcoin, Tron, XRP Ledger and Solana, as well as Arbitrum, Avalanche, Optimism, Base and Polygon.
Its analysis indicates the attackers had prepared for the operation at least 36 hours before executing the theft. On Ethereum, they used a pre-signed authorisation to turn a Binance hot wallet into a mechanism for transferring funds to an attacker-controlled address.
“The first theft of the night came on the XRP Ledger. Between 20:05 and 20:09 UTC, five Binance wallets sent 233.46 million XRP to a single attacker address, leaving each wallet with only its minimum balance.
“That XRP has remained in place since. Binance wallets on Solana and Optimism followed shortly after 20:10 UTC.”
“At 20:20 UTC, a Binance Bitcoin hot wallet sent 18 270 BTC to an attacker address, which began splitting the funds into round 1 000 BTC and 100 BTC pieces inside the same block. That technique, called a peel chain, makes funds harder to follow. Within two minutes, a Binance hot wallet on Tron sent 612.7 million USDT and 46.4 million TRX to the attacker.”
Substantial ramifications
The incident highlights the security risks facing crypto-currency exchanges, particularly the potential consequences of compromised systems that authorise transactions across multiple blockchain networks.
The scale of the breach also raises questions about the effectiveness of existing safeguards against unauthorised withdrawals, even at major exchanges holding billions of dollars in customer assets.
“The remaining stolen crypto-currency could be moved through cross-chain bridges, swap services and over-the-counter brokers as the attackers attempt to convert or obscure the origins of the funds,” says TRM Labs.
TRM Labs obtains its information by analysing publicly available blockchain data, including crypto-currency transactions, wallet addresses and fund movements across different networks. It combines this on-chain analysis with off-chain intelligence, such as investigations, threat intelligence and information from law enforcement and industry partners.
Share
