Currently, investigators link the US$5.912bn theft to North Korea’s TraderTraitor group, after a compromised engineer’s laptop enabled unauthorized withdrawals

Crypto exchange Binance has disclosed a security incident affecting roughly US$6.3bn in assets, making it the largest cryptocurrency theft on record.

The firm said nearly US$3bn had been frozen on-chain, while Tether and Circle have separately frozen more than 1.567bn USDT and 800mn USDC; Arbitrum’s Security Council has frozen about US$30.5m.

The initial assessment is that an attacker had compromised a DevOps engineer’s laptop, entered a service container, and submitted unauthorized withdrawal transactions. No evidence has been found to suggest that wallet private keys had been leaked, and the firm has pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and corporate funds.

All deposits and withdrawals have been suspended, and the firm has revoked affected address authorizations and enlisted law enforcement and blockchain-intelligence partners.

At approximately US$5.912bn of estimated losses —almost four times the next-largest crypto theft — the incident has exceeded the roughly US$1.5bn stolen from Bybit in February 2025.

Links to North Korean threat actors

One cybersecurity firm, TRM Labs, has attributed the attack with high confidence to North Korea’s TraderTraitor group, citing similarities to the Bybit and KelpDAO intrusions: small Tornado Cash withdrawals, advance staging, and a burst of pre-signed transactions. It said the attackers prepared 50 authorizations for consecutive wallet nonces, ensuring one would remain valid, then moved the hot wallet’s entire balance — 167,464 ETH and 63 tokens, including 1.615 billion USDT — to an attacker-controlled address. Another firm, Chainalysis, has also linked the theft to North Korea with high confidence, after observing funds from the recent Bitget exploit commingled with Binance proceeds.

Elliptic has put the total stolen at US$6.43bn, and said about US$2.84bn had been frozen, leaving roughly US$3.33bn across about 43 addresses, including 511,861 ETH, 18,270 BTC, 233 million XRP, and 670 million TRX. It has argued that the attacker induced Binance systems to sign transactions rather than stealing private keys — similar to the Bybit compromise. However, the firm has urged caution because the laundering differs from typical North Korean patterns: stolen USDT was held for 37 minutes on Ethereum and 46 minutes on Tron, and funds were moved through market makers and DeFi lending protocols rather than bridges, according to a Hacker News report.

Binance later announced it had found additional breach points beyond the laptop, while co-CEO Richard Teng had emphasized that the attack was complex and did not involve a single engineer’s permissions. In a later update, Binance said it had contained affected infrastructure, revoked authorizations, strengthened controls, and frozen about US$3bn while working to restore withdrawals safely.

Security experts have noted the case underscores how social engineering and compromised workstations can defeat technical controls. Cynthia Kaiser of Halcyon has called the theft a national-security issue, while Sophos’s Rafe Pilling described TraderTraitor as adept at mapping victim processes and using fake applications to gain access.