Binance puts hack loss at $6.3 billion, the largest crypto theft on record; TRM and Chainalysis point to North Korea
Binance said about $6.3 billion was taken, froze roughly $3 billion with partners, paused deposits and withdrawals and pledged to cover all losses, while blockchain analytics firms tied the attack to North Korea's TraderTraitor unit.
The outflow from Binance hot wallets first spotted on Thursday evening is now confirmed by the exchange as a security incident affecting about $6.3 billion of assets. That is more than four times the $1.5 billion Bybit theft of February 2025, previously the largest crypto hack on record.
| Item | Detail |
|---|---|
| Assets affected (Binance) | About $6.3B |
| Outflow tracked by TRM | About $6.36B across 10 blockchains, mostly within ~20 minutes |
| Frozen with partners | Roughly $3B |
| Deposits / withdrawals | Temporarily suspended during security checks |
| Attribution | TRM (“high confidence”) and Chainalysis: North Korea’s TraderTraitor unit |
| Previous record | Bybit, $1.5B (Feb. 2025) |
What Binance says — The exchange said it will cover the losses and that user funds are safe; founder Changpeng Zhao said he expects customer balances to be fully covered. Binance said it found no evidence that a wallet private key leaked, and Al Jazeera reported that an initial review points to an engineer’s compromised laptop. A technical post-mortem is promised once the investigation ends.
Why it matters — Binance is the largest crypto exchange by trading volume, so a freeze on deposits and withdrawals there slows the flow of dollars and stablecoins in and out of the market. The size of the theft and the North Korea link also raise the odds of fresh pressure from U.S. regulators and lawmakers on exchange security, just as crypto prices were already falling with the tech selloff.
Market reaction — Bitcoin dropped below $79,000 on Thursday evening as the outflows surfaced and stayed under pressure into Friday morning.
WMR data — Check exchange volume rankings and coins with sudden volume spikes on the crypto dashboard; risk appetite readings such as the VIX and Fear & Greed sit on Market pulse.
What to watch next — When Binance reopens withdrawals and whether net outflows follow, how much of the frozen $3 billion is recovered, any statement from the FBI or Treasury, and Binance’s technical post-mortem.
Sources
All content on this site is for informational purposes only and is not investment advice. You are solely responsible for your investment decisions. Past performance does not guarantee future results. Editorial & Corrections Policy