What Binance Says Happened
Early checks suggest the breach may have involved a compromised engineer's laptop, which let an attacker make unauthorised withdrawals. The incident affects Binance.com only. Binance.US, the much smaller platform serving American residents, said it was not affected. Coinbase also said it was unaffected and was monitoring the situation.
Co-chief executive Yi He thanked various crypto issuers for freezing assets. "Safety first: withdrawals are currently disabled until the environment is confirmed to be secure," she said. Binance didn't directly say whether North Korea was involved, but stated: "We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice."
Links to North Korean Hackers
The attack dwarfs the record-setting $1.5bn hack on the Bybit exchange in 2025. Two analytics firms have pointed to a North Korean hacking unit called TraderTraitor. TRM Labs said several elements of the attack resemble earlier North Korean-linked incidents, including the Bybit hack. Its global head of policy, Ari Redbord, called the hack a "watershed moment" unlike anything the industry has seen. He added that the attacker still holds an enormous amount of stolen assets, so efforts to trace and recover the funds are far from over.
Chainalysis said it has "high confidence" that the same group is behind the attack. Its Head of Research, Eric Jardine, urged every exchange to stay vigilant, since exchanges are attractive targets because of the sheer value they hold.
Other Firms Step In to Freeze Funds
Tether and Circle have frozen about $2.4bn of assets between them. Circle, issuer and co-creator of the USDC dollar-backed cryptocurrency, said it froze more than $800m linked to the incident. Its chief executive, Jeremy Allaire, said the company was "closely tracking reports of a potential exploit involving Binance." Tether, which issues USDT, froze around $1.6bn. "Protecting the industry and our partners is our main priority," said its CEO, Paolo Ardoino. World Liberty Financial, a crypto company linked to US President Donald Trump and his family, said it also worked with partners to freeze stolen funds.
Several industry observers had raised concerns about a possible hack hours before Binance confirmed the problem. Bitcoin fell by more than 4% after the alerts, and Ethereum, Solana and other major cryptocurrencies also dropped sharply.
Binance was founded in China in 2017 and is estimated to have more than 300 million registered users worldwide. It said in 2024 that it holds more than $160bn in assets under custody, and it has faced regulatory scrutiny around the world.
