Binance, the world’s largest cryptocurrency exchange by trading volume, Thursday was hit with a security breach incident that has now seen an estimated $6.3 billion in impact.
The trading platform in a statement on Friday said an investigation found a compromised laptop belonging to a DevOps engineer may have allowed an attacker to reach an internal service container and submit unauthorized withdrawal requests.
In context, this would be the largest single crypto theft ever recorded in history, with about $3 billion already frozen in affected assets.
In a finding by blockchain analytics firms TRM Labs and Chainalysis, they are now pointing fingers with high confidence that the attack may be from TraderTraitor, a North Korea-linked group associated with Lazarus.
The exchange platform, additionally, has stressed that it found no evidence that wallet private keys were leaked and that a full technical post-mortem will follow.
Mark Karpeles, chief executive of Karpeles Lab and former head of Mt. Gox, told Reuters that Binance appeared to have distributed its assets across multiple systems to limit the damage from an individual attack of this scale.
“But even so a single hack is a large loss. It looks like the attacker somehow managed to get a valid delegation for both Binance 14 and Binance 16, which means they likely found the private key used by those addresses,” he added.
The total crypto theft would mark a history of roughly four times the previous record of $1.4 billion to $1.5 billion taken from Bybit in February last year. In which the FBI confirmed in February last year that North Korea’s TraderTraitor organization was responsible for the theft
Yi He, a Binance co-CEO in a statement, has given a stronger update to the situation saying:
“User funds are safe. Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement,” He added “we will share a full post-mortem once the investigation is complete.”
The CEO has asked that users rely only on official Binance channels for updates. The company has not given a timeline for resuming services or completing reimbursement.
Binance had described the $6.3 billion as its estimate of total impact. The figure could slightly increase as tracing continues and asset prices move.
“I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered,” Changpeng “CZ” Zhao, Binance founder and major shareholder, said in a statement
Much of the frozen total was blocked by stablecoin issuers.
Tether has said it froze more than $1.567 billion in USDT, while Circle trading platform put its own freeze on more than $800 million in USDC, saying it acted in coordination with law enforcement.
Further freezes came from Ripple*, which accounted for about $200 million, and World Liberty Financial, working with custodian BitGo, froze about $27 million in stablecoins and about $2 million in its own tokens.
North Korean hacking groups have become among the world’s most prolific threats to the crypto industry, repeatedly targeting exchanges and other platforms for large-scale theft.
In the 2022 attack on Ronin Network, they were named as being involved in the theft of $625 million in crypto stolen, and in last year*’s breach of Bybit, with about $1.5 billion, plus the recent theft this year of $387 million from Bitget.
Chainalysis estimated North Korean groups stole $2.02 billion in 2025 alone, bringing their cumulative total to at least $6.75 billion. The suspected involvement of TraderTraitor in the Binance incident places the latest breach within that history of high-value attacks.
Binance has not named a perpetrator and said it is working with law enforcement to confirm the attackers’ identity. No government has publicly confirmed the attribution.
