Binance's $6.3 billion hack is the largest crypto theft on record

Binance, the world's largest crypto exchange, has suffered the largest crypto theft on record. The company said a security incident affected about $6.3 billion in client assets taken from its hot wallets, with around $3 billion frozen on-chain. Binance has paused withdrawals, pledged to cover every dollar of the loss, and said on Saturday that it has already restored backing for about 90% of the stolen assets. The episode is a sharp reminder that where crypto is held matters as much as what is held.

What happened

It is still not clear exactly how the attack worked. Binance first said the incident may have involved "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." Co-CEO Richard Teng later said the attack involved a more complex process rather than the misuse of a single engineer's permissions. Binance also said, "We have found no evidence of any wallet private key leak," and promised a detailed technical post-mortem once the investigation is complete.

Blockchain analysts quickly pointed to a familiar culprit. TRM Labs, a blockchain intelligence firm, said several features matched earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: "small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst." Chainalysis said the theft appeared to be the work of the cybercrime group TraderTraitor. Late Saturday, the FBI said it had determined North Korea was responsible, and that the thieves had laundered the stolen assets by converting them into Ethereum.

The broader crypto industry moved fast to limit the damage. Circle CEO Jeremy Allaire said the company had frozen more than 800 million in USD Coin tied to the incident. Tether CEO Paolo Ardoino said his firm had frozen more than 1.5 billion of its stablecoin that may have been related to the breach. Ripple said it was actively freezing affected funds held in RLUSD, its dollar-backed stablecoin. Bitcoin fell more than 4% to $77,187.60 on Friday as the hack weighed on crypto markets.

How Binance is covering the losses

Binance says customers will not take the hit. "Binance will absorb the financial impact of these stolen funds, not our users," the exchange said. It is funding the replacement from its Secure Asset Fund for Users, or SAFU, a protection fund created in 2018 for exactly this kind of event, along with a portion of its futures insurance fund and its own corporate treasury.

As of Saturday, Binance said all BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances were "fully backed 100%." The remaining 10% consists of tokens outside its top 10 that are "less liquid, which means they may take longer to source in the required amounts." Binance said it will keep buying those tokens through market and over-the-counter channels until every token is fully covered.

An important distinction: restoring backing is not the same as getting the money back from the attackers. Binance is replacing the assets with its own funds while recovery efforts continue. Deposits kept working throughout, and Binance said it remains on track to reopen withdrawals on Sunday, Nov. 1, subject to security checks.

Why it matters for people building wealth

For anyone holding crypto, this is a lesson in custody risk. Assets left on an exchange depend on that exchange's security and its ability to pay when something goes wrong. Binance had the reserves to absorb a multibillion-dollar loss. Not every platform does. Hacks are not rare in this industry: Bybit lost roughly $1.5 billion in 2025, and Bitget more recently lost more than $350 million in digital assets.

Even when customers are made whole, they can lose access. Binance users have been unable to withdraw for days. For people who need liquidity on a deadline, a frozen exchange can be costly even if the balance is eventually safe. Spreading holdings across platforms, keeping long-term holdings in self-custody, and understanding an exchange's protection fund before depositing are practical ways to reduce that risk.

Lessons for founders and builders

For founders, the security lessons apply well beyond crypto. The suspected entry point was a single engineer's laptop that led to a service container able to submit withdrawals. Whatever the final post-mortem shows, the pattern is familiar: one compromised device or credential can reach systems that move money. Limiting what any single machine or person can authorize, requiring multiple approvals for large transfers, and watching for unusual staging activity are the kinds of controls that matter most.

The freezes also show the value of an ecosystem that can act together. Circle and Tether alone froze more than $2 billion between them, which shrank what the attackers could actually use.

What to watch

Watch whether withdrawals reopen on schedule on Sunday, how quickly Binance covers the final 10% of less liquid tokens, and what its technical post-mortem reveals about how the attackers got in. Also watch how much of the roughly $3 billion frozen on-chain can be returned, and whether the thieves manage to move the rest through further laundering stages.

Sources

• Circle, Tether freeze funds impacted by potential Binance security issue, CNBC
• Binance CEO says 90 percent of stolen crypto has been replaced, The Verge
• Binance has covered 90% of stolen user assets in $6.3 billion hack, CNBC