Hackers Steal Billions From Binance in Record Cyber Attack

Hackers stole US$6.3 billion from the world's largest cryptocurrency exchange, Binance, in a rapid attack that lasted about 20 minutes and halted platform withdrawals.

What Happened

Third-party cyber security firms examined public cryptocurrency flows and noted that the attack took about 20 minutes. Binance CEO Richard Teng stated in a video that the attacker used a self-destruct mechanism to destroy tools and traces, which made investigation harder. Binance initially pointed to a compromised engineer's laptop and later noted additional breaches.

Reaction

Ido Ben-Natan, the chief executive of crypto security company Blockaid, called it the biggest hack in the world, ever. CrowdStrike noted that a previous US$1.5b theft from Bybit in 2025 was formerly the largest single financial theft reported. Meanwhile, CrowdStrike and at least two other cyber security firms attributed the Binance attack to TraderTraitor, a North Korean state hacker group.

Recovery Efforts

Following the theft, various partners and crypto issuers rushed to freeze funds. Circle and Tether froze about US$971 million and $825 million in stablecoins within an hour. Binance stated that about US$3b of stolen funds were frozen by partners. However, blockchain intelligence company TRM Labs observed hackers racing to convert loot into non-freezable cryptocurrencies, leaving at least US$2.4b beyond any issuer's reach. Binance announced plans to refund customers using its own funds and a US$1b bitcoin reserve, having set aside funds to cover 90% of losses and committing to cover the remaining 10%.

Context

Cryptocurrency relies on a decentralised blockchain network rather than traditional banking authorities, allowing digital funds to move rapidly across borders. This fast and public structure makes digital assets an attractive target for hackers and state-backed groups seeking to evade traditional financial controls. Major exchanges like Binance frequently face severe cyber security threats as bad actors exploit endpoint vulnerabilities and automated transaction tools.