Binance, the world largest cryptocurrency exchange, has suffered a theft of about $6.3 billion, the biggest crypto hack on record. Blockchain investigators attribute the attack with high confidence to TraderTraitor, a North Korean state-backed unit linked to the Lazarus Group. Binance says customer funds will be covered in full, and roughly $3 billion of the stolen assets have already been frozen.
Twenty Minutes That Moved Billions
The attack, on Thursday, drained funds across ten blockchains in a burst of activity that investigators say lasted about 20 minutes at its most intense. TRM Labs traced roughly $6.36 billion leaving Binance wallets, and identified the likely entry point as a compromised laptop belonging to a DevOps engineer, which allowed the attacker to submit unauthorised withdrawals.
Binance chief executive Richard Teng stressed the incident was a complex, multi-point breach rather than a single click. Our our look at the data behind Bitcoin energy debate has previously covered the strange economics of crypto self-custody and education; this episode shows the risks sitting inside the intermediaries instead.
The Binance Hack and the North Korea Connection
TRM Labs and Chainalysis both point to TraderTraitor, the unit the FBI blamed for the $1.5 billion Bybit theft in February 2025. If the attribution holds, this single operation stole about four times that record haul, and 2026 becomes the most hacked year in crypto history with more than $8 billion taken.
As the investigation into the Lazarus link reports, investigators believe the group prepared for at least a day and a half, funding its operational wallets through small Tornado Cash withdrawals, and that the attacker still controls around $2.4 billion beyond the reach of freezes, including large amounts of ether and bitcoin now being laundered through peel chains.
The mechanics of the freeze effort are themselves a sign of how the industry has changed. Stablecoin issuers Tether and Circle froze roughly $1.57 billion and $800 million respectively at the issuer level, something impossible with bearer-style assets and controversial among crypto purists, who note that freezability is exactly the centralisation the technology was meant to escape. In a crisis, convenience and control tend to win that argument.
Customers, Cover and the SAFU Question
Binance has pledged to cover every loss using its Secure Asset Fund for Users plus company funds. The SAFU fund holds roughly $1.2 to $1.3 billion, mostly in bitcoin, so the majority of the cover must come from the company balance sheet, a test of the exchange reserves that will be watched across the industry.
Deposits have resumed, but withdrawals remain suspended while the withdrawal service is rebuilt, with the exchange expecting to restore them by Sunday and promising a full technical post-mortem and updated proof of reserves.
A theft of this size is no longer just a company problem; it is an argument about whether centralised exchanges can ever be secured against state-level attackers. The industry answer, and regulators response, will shape how much of the world savings crypto is trusted to hold.
