Cryptocurrency giant Binance announced on Thursday that a security incident on its platform has impacted approximately $6.3 billion worth of assets. The world's largest cryptocurrency exchange stated that nearly $3 billion of these funds have been frozen on-chain so far. In response to the breach, stablecoin issuers Tether and Circle reported freezing more than 1.567 billion USDT and 800 million USDC respectively. Additionally, the Arbitrum Security Council executed a transaction to freeze about $30.5 million related to the exploit.
Binance's initial investigation suggests the incident involved a compromised DevOps engineer's laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions. The exchange clarified that there is no evidence of a wallet private key leak. To mitigate further losses, Binance temporarily suspended deposits and withdrawals, revoked affected address authorizations, and engaged law enforcement and blockchain intelligence partners. The company confirmed it will cover all losses using its Secure Asset Fund for Users (SAFU) and internal funds, with withdrawals expected to resume within 48 hours following a security revamp.
This event marks the largest cryptocurrency heist recorded to date, surpassing the $1.5 billion theft from Bybit in February 2025. Blockchain intelligence firm Chainalysis estimated the amount stolen at approximately $5.912 billion at the time of the theft, nearly four times the amount taken in the next largest crypto heist. TRM Labs has attributed the attack to North Korean threat actors with high confidence, linking it to the group TraderTraitor, which was also behind the 2025 Bybit heist and the KelpDAO hack in April 2026.
According to TRM Labs, preparation for the attack began at least 36 hours prior to the theft. The attackers took over a Binance hot wallet by submitting a single transaction containing 50 pre-signed authorizations. This technique involved preparing signatures for consecutive transaction counts to ensure validity when executed. Three minutes and 24 seconds after the delegation, the operator instructed the hot wallet to transfer its entire balance, including 167,464 ETH and 63 tokens such as 1.615 billion USDT, to an attacker-controlled address.
Elliptic's chief scientist, Dr. Tom Robinson, assessed that North Korea-linked actors perpetrated the theft, citing similar tradecraft and the commingling of funds from the recent Bitget exploit. Elliptic noted that rather than stealing private keys, the attacker manipulated Binance's own systems to sign transactions on their behalf, a method resembling the Bybit theft where infrastructure and personnel were compromised instead of cryptography. So far, Tether, Circle, Ripple, and World Liberty Financial have frozen about $2.67 billion in stablecoins, while Arbitrum has frozen approximately $30 million in ETH and ARB.
Despite these efforts, the attacker retains control of more than 420,000 ETH and 18,270 BTC, valued at roughly $2.4 billion, along with smaller amounts on other chains. Elliptic reported that while 2.84 billion in funds have been frozen, the attacker controls around $3.33 billion in assets spread across about 43 wallet addresses that cannot be frozen by an issuer. This includes 511,861 ETH, 18,270 BTC, 233 million XRP, and 670 million TRX.
Links to North Korea are based on several factors, including the commingling of funds from the Binance and Bitget exploits into the same Ethereum address. Attackers utilized small Tornado Cash withdrawals to fund their wallets and executed pre-signed transactions in a single burst, techniques observed in previous hacks attributed to the regime. However, Elliptic urged caution in attribution due to deviations in laundering patterns; unlike typical North Korean groups that swap stablecoins for native assets within minutes, this attacker held stolen USDT for 37 to 46 minutes without converting most of it and utilized market makers and DeFi lending protocols differently than seen after the Bybit hack.
Binance co-CEO Richard Teng stated that while the incident may have started with a compromised laptop, the attack was complex and not a simple one-click action. The company has since revealed that its ongoing investigation uncovered additional points of breach beyond the initial laptop compromise. Binance is coordinating with law enforcement to confirm the identity of the criminals and bring them to justice.
Sources: The Hacker News.