Overview
- Binance estimates roughly $6.3 billion was taken and reports that about $3 billion of the affected assets have been frozen on the blockchain by exchanges and token issuers.
- The company says an initial probe points to a compromised DevOps engineer laptop that let an attacker submit unauthorized withdrawal transactions from hot wallets.
- Blockchain intelligence firms TRM Labs and Chainalysis have flagged technical and behavioral indicators tying the operation to North Korea‑linked units, though formal government attribution is still unfolding.
- In response, Binance suspended deposits and withdrawals as a precaution and announced it has reserved more than $6.34 billion from its SAFU emergency fund and company coffers to make users whole.
- Markets fell after the breach and the episode sharpens regulatory and investor scrutiny of centralized custody, because hot wallets connected to online systems can be exposed to operational compromise.