Cryptocurrency giant Binance said on Thursday that a “security incident” on its platform has impacted about $6.3 billion worth of assets.
The world’s biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.
Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million USDC related to the incident, respectively. The Arbitrum Security Council is said to have executed a transaction to freeze about $30.5 million from the Binance Exploit.
“Initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” Binance said in an update.
The company said there is no evidence of a wallet private key leak, adding it will cover all losses from the Secure Asset Fund for Users (SAFU) fund and its own funds.
Out of an abundance of caution, Binance has also taken the following steps –
- Temporarily suspended deposits and withdrawals while security checks are completed
- Revoked the affected address authorization;
- Engaged law enforcement and blockchain intelligence partners to trace and recover funds
“We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice,” Binance said.
In an update, Binance said it expects withdrawals to resume in 48 hours, after its team “completes a security revamp of the withdrawal service and its related addresses.”
The development makes it the biggest cryptocurrency heist recorded to date, surpassing the theft of about $1.5 billion from Bybit in February 2025. The incident was subsequently attributed to North Korea.
“Our current estimate on the amount stolen is approximately $5.912 billion at time of theft, nearly 4x the amount stolen in the next largest crypto heist,” blockchain intelligence firm Chainalysis said in an X post.
Attributed to North Korea’s TraderTraitor
TRM Labs has attributed the record-breaking hack targeting Binance to threat actors from North Korea with high confidence. The blockchain analytics company linked it to TraderTraitor, which was also behind the 2025 Bybit heist, based on what it said were “robust on and off-chain intelligence sources.”
“Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst,” TRM Labs said.
“The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit.”
TRM Labs said preparation for the attack was underway at least 36 hours before the theft, with the attackers taking over a Binance hot wallet to send its “entire balance to an attacker-controlled address” –
At 20:20 UTC, the operator submitted a single transaction containing 50 authorizations. Each was signed by the Binance hot wallet, and each pointed it to a sweeper contract that accepts instructions only from the operator. Every wallet keeps a running count of its transactions, called a nonce, and an authorization works only at the count the wallet has reached at the moment it executes. The Binance hot wallet processes a steady flow of withdrawals, so its count keeps moving forward. By preparing signatures for 50 consecutive counts, the attacker guaranteed that one would still be valid when the transaction executed. One matched, which was all the attacker needed. The signatures were produced in advance as a batch.
Three minutes and 24 seconds after the delegation, the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
The most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains. The batch of 50 pre-signed authorizations suggests the access may have been limited in time, or that signatures had to be requested through a system. Binance has yet to publish a root cause.
Chainalysis has also linked the hack to the Democratic People’s Republic of Korea (DPRK) with a high degree of confidence, stating it “observed funds stolen by DPRK in last month’s Bitget exploit commingling with funds stolen from Binance.”
“The ability to quickly identify and understand illicit activity is increasingly important as North Korea increasingly uses sophisticated automation to move and obscure stolen funds,” the company noted earlier this month. “Investigators must keep pace with these tactics while applying the judgment and expertise needed to make sense of complex on-chain activity.”
So far, Tether, Circle, Ripple, and World Liberty Financial have frozen about $2.67 billion in stablecoins, and Arbitrum’s Security Council has frozen about $30 million in ETH and ARB. The attacker continues to retain control of more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, plus smaller amounts on other chains.
Elliptic’s chief scientist and founder, Dr. Tom Robinson, told The Hacker News cryptocurrency assets with a total value of $6.43 billion were stolen from Binance, assessing North Korea-linked actors perpetrated the theft, citing similar tradecraft and co-mingling of funds from another hack attributed to them.
“Rather than stealing Binance’s private keys, the attacker appears to have been able to get Binance’s own systems to sign transactions on their behalf,” Elliptic said.
“This closely resembles the Bybit theft, in which North Korean hackers compromised a developer’s machine at the wallet provider Safe{Wallet} and manipulated the transaction that Bybit’s signers approved. In both cases, it was the infrastructure and people around the wallets that were compromised, not the cryptography.”
The company also noted that 2.84 billion of funds have been frozen, while the attacker is in control of around $3.33 billion of assets that cannot be frozen by an issuer and are spread across about 43 wallet addresses. This includes 511,861 ETH (1.15 billion), 18,270 BTC ($1.43 billion), 233 million XRP, and 670 million TRX.
The links to North Korea are based on the following factors –
- Funds stolen from Binance and funds linked to the Bitget exploit have been sent to the same Ethereum address, 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7.
- Attackers funded their wallet with three small Tornado Cash withdrawals, tested the attack code in advance, and executed pre-signed transactions in a single burst, similar to what was observed in Bybit and KelpDAO exploits.
- The likely use of social engineering to trick employees into executing malware under the pretext of a coding test or a bogus project, a technique employed in DMM Bitcoin and Bybit hacks.
Despite these commonalities, Elliptic has urged caution in attributing the activity to North Korea, citing deviations from previously observed laundering patterns in terms of speed and methodology, as well as the absence of a root cause.
“DPRK launderers typically swap stolen stablecoins for native assets within minutes,” Robinson said. “The attacker held the stolen USDT for 37 minutes on Ethereum and 46 minutes on Tron without converting most of it. North Korean-linked groups typically move funds faster and more efficiently. The use of market makers and DeFi lending protocols differs from the bridge-heavy laundering seen after the Bybit hack.”
Chainalysis has also concurred with this assessment, stating it’s observing never-seen-before laundering patterns with the stolen funds from the Binance exploit.
“Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds,” it said. “Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.”
“Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses. This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.”
When asked if there were any indicators that could have helped identify and prevent this attack beforehand, Robinson said it was possible only in hindsight.
“The day before the attack, the attacker funded their wallet through the Tornado Cash mixer,” Robinson added. “A few hours before, they tested their code on three wallets. None of this would have stood out at the time.”
Assuming the Binance hack was orchestrated by North Korea, the development once again signals how the threat actors continue to operate with impunity despite continued law enforcement efforts and sanctions pressure.
“The rewards are huge and the risks to them are small,” Robinson said. “The hackers are beyond the reach of law enforcement. North Korea is already heavily sanctioned, and crypto theft is one of the few ways it can still raise billions.”
“They target people rather than technology, through fake job offers and malware, and it only takes one compromised laptop. They then launder the funds through mixers, bridges and OTC brokers, mostly out of reach of Western law enforcement. “However, tracing and freezing have improved, which makes each theft less profitable.”
Binance has since revealed that its ongoing investigation has “uncovered additional points of breach” that goes beyond the compromised laptop, and that it’s “doing all we can in coordination with law enforcement to resolve it.”
The company has also disclosed that it’s “recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms, and industry partners to trace, freeze and recover additional funds.”
“Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop,” Binance co-CEO Richard Teng said. “That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.”
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.”
Investigation Remains Ongoing
In a new recovery update shared late Friday, Binance said it’s working with internal and external security experts to lay out the entire attack sequence, identify all contributing factors, and determine the appropriate measures to prevent such incidents from happening again.
The company also said it has undertaken the following steps –
- Contained the compromised infrastructure, revoked affected authorizations, and implemented additional controls to prevent further unauthorized activity.
- Traced and frozen approximately $3 billion on-chain to date, with more recovery efforts to follow.
- Strengthened security checks across affected infrastructure.
- Temporarily suspended withdrawals while conducting additional security reviews, implementing remediation measures and validating the integrity of affected systems.
- Continued working to restore withdrawal services safely.
“We take full responsibility for addressing this security incident, strengthening our security infrastructure, and ensuring our users are protected,” it said.
In a post shared on LinkedIn, Cynthia Kaiser, senior vice president of the Halcyon Ransomware Research Center and the former Deputy Director of the FBI’s Cyber Division, said that manipulating people and trust continues to be the most effective method to obtain access to target networks.
“There are no ‘North Korean criminal hackers,'” Kaiser said. “They are all ‘North Korean state hackers’ and this theft is a national security issue not just a financial crime.”
TraderTraitor exemplifies this modus operandi by comprising software developer or engineers’ workstation, and then abuse that access to perform reconnaissance and develop the technical attack to steal steal cryptocurrency from the victim organization using rapid, coordinated transactions, Rafe Pilling, senior director of threat research at Sophos, said.
“This group are experts at mapping out the technical and business processes necessary to make authorized transfers and develop a custom attack tailored to the victim,” Pilling told The Hacker News.
“This group in particular are somewhat artists in terms of getting into these distributed finance companies. TraderTraitor focus on large operations. In the past, they’ve developed their own fake applications and tried to use those to get inside organizations.”
(The story has been updated after publication to reflect the latest developments and additional insights from Elliptic.)
