Binance lost $6.3 billion in cryptocurrency from its transaction wallets in the single largest heist in the industry's history. The attack struck the global platform Binance.com, bypassing the US-specific Binance.us infrastructure. Co-CEO Richard Teng described the incident as a "complex attack," noting that the initial intrusion began with a compromised laptop that granted attackers access to a service container. They used this access to submit unauthorized withdrawal transactions.
The heist unfolded with terrifying speed. Blockchain records show the bulk of the theft occurred in roughly 20 minutes, starting shortly after 20:00 GMT on Thursday. US blockchain analytics firm TRM Labs stated that the attackers compromised Binance's "signing infrastructure," the system that authorizes transactions. This allowed them to issue instructions that drained the affected wallets before security measures could engage.
Who pulled the trigger? While Binance and law enforcement have not issued a formal confirmation, the digital fingerprints point north. TRM Labs attributed the attack to a North Korean unit known as TraderTraitor, a judgment made with "high confidence." Jonathan Levin, co-founder and CEO of Chainalysis, echoed this assessment on X, stating the hack was "likely done by DPRK (North Korea) group TraderTraitor." No other group has claimed responsibility.
Binance is now playing defense in two arenas. First, they are chasing the money. Partners have frozen approximately $3 billion of the stolen assets, limiting the hackers' ability to cash out. Second, they are protecting their balance sheet. The company reserved more than $6.34 billion in internal funds, including $5 billion in impacted token assets, to ensure user deposits remain covered. Teng assured users that their funds are safe, despite the temporary halt on all withdrawals and deposits.
The platform aims to resume withdrawal services within 45 hours of the announcement. Meanwhile, the $6.3 billion figure is not final; Binance warned it may rise as teams work with law enforcement and blockchain intelligence firms to trace additional assets. The coming days will determine if the frozen funds can be recovered or if the exchange must absorb the full loss from its reserves.