Binance suspended deposits and withdrawals after an estimated $6.3 billion was drained from wallets in a suspected cyberattack that could rank as the biggest crypto attack in history. Co-founder Yi He wrote on X that user funds remain safe and that the exchange will cover all hacking losses.
Binance Engineer Laptop Compromised in Attack
An initial investigation linked the security breach to a compromised laptop belonging to a Binance engineer. That unauthorized access allowed an attacker to enter Binance’s systems and execute withdrawals, according to the exchange. Binance and its partners managed to freeze about $3 billion of the drained funds that can potentially be recovered.
Kevin March, a co-founder of cryptocurrency trading firm JPEG Trading, described the scale of the incident as unprecedented. March noted that Binance’s size makes it more insulated, stating that if this happened to any other business in crypto other than Binance, it would’ve been catastrophic.
North Korean Hacking Collective Suspected
Security researchers from TRM Labs and Pangolin Intelligence determined that the cyberattack appeared to be the work of a North Korean hacking collective. Nick Carlsen, a senior TRM investigator, told The Wall Street Journal that this was absolutely North Korea. Representatives of North Korea have previously denied allegations of hacking crypto exchanges.
User funds are safe. Binance will cover all hacking losses.Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.We will share a full post-mortem once the investigation is complete. Please…
Pyongyang has turned illicit digital intrusions and fraudulent schemes into a massive, systematic enterprise, placing heavy emphasis on digital asset thefts alongside widespread efforts to dupe Western organizations into employing North Korean programmers. Cybercriminals tied to North Korea made off with roughly $1.5 billion in cryptocurrency from the Bybit trading platform during 2025.
Polymarket Suffers Breach During Same Window
The Binance security incident unfolded just hours after decentralized prediction market operator Polymarket confirmed a separate cyberattack on its platform. An attacker stole at least $2.7 million in user funds, prompting Polymarket to pause trading for an hour. Investigators at Hudson Rock tracked the Polymarket security breach back to an intrusion affecting third-party website monitoring utility DebugBear, an entity that announced earlier on Thursday that it was actively dealing with its own security breach.
Binance security teams are reviewing all relevant information with urgency. The exchange has not yet officially verified either the identity of the perpetrators behind the breach or the exact monetary value of the digital currencies the suspected threat actors managed to steal.
Frequently Asked Questions
How much money was ultimately lost in the Binance hack?
An estimated $6.3 billion was drained from wallets during the incident, though Binance and its partners successfully froze approximately $3 billion of those funds for potential recovery.
Who do researchers believe carried out the cyberattack?
Investigators from TRM Labs and Pangolin Intelligence concluded that the assault bore the hallmarks of a North Korean hacking group, according to remarks provided to The Wall Street Journal.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
What caused the security vulnerability at Binance?
An initial investigation linked the hack to a compromised laptop from one Binance engineer, which allowed an attacker to gain access to Binance’s systems to make withdrawals.
How does this incident compare to past crypto heists?
If estimates hold up, the suspected Binance hack would be the biggest crypto attack in history, following the 2025 theft of about $1.5 billion worth of crypto from the Bybit exchange by North Korea-linked hackers.
Worth a look