Overview
- Late Thursday into early Friday, wallets linked to Binance moved roughly $6.3 billion across multiple blockchains, a sum that makes this the largest recorded crypto theft.
- Binance temporarily halted deposits and withdrawals and says about $3 billion of the stolen assets have been frozen on-chain with help from stablecoin issuers and other partners.
- Blockchain intelligence firms Chainalysis and TRM Labs report high-confidence links to a North Korea–aligned hacking unit called TraderTraitor while Binance says its probe is ongoing and has not publicly named the attacker.
- Binance’s initial forensics point to a compromised DevOps engineer laptop that allowed access to a service container and unauthorized withdrawals, with follow-up analysis suggesting the attackers also manipulated hot-wallet signing or authorization systems.
- The breach knocked down major crypto prices, prompted urgent industry freezes and recoveries, and pushed regulators and exchanges to reassess custody practices even as Binance pledges to make users whole from its reserves and insurance fund.