Binance said Friday that a security incident impacted about $6.3 billion in client assets, with around $3 billion frozen on-chain, marking the largest crypto hack on record.
The company later added it began recovering assets impacted by the breach after pledging to cover losses using its Secure Asset Fund for Users, which the company created in 2018 as a protection for clients in the event of a hack.
It wasn’t clear how the attack took place. The world’s largest crypto exchange initially said the hack may involve “a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” However, Co-CEO Richard Teng later said the attack involved a more complex process rather than the misuse of a single engineer’s permissions.
It wasn’t clear either who was responsible for the breach. But TRM Labs, a blockchain intelligence and AI investigations company, pointed to North Korean hackers as the potential culprits. “Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst,” the company said in a post.
Blockchain data platform Chainalysis also said this appears “be the work of North Korean cybercrime group TraderTraitor. This group has repeatedly targeted the cryptocurrency industry, exchanges, DeFi protocols, and investors, to raise funds for the regime. We base our intelligence assessment on on-chain activity observed in the hours following the hack.”
Binance temporarily suspended withdrawals while it overhauls its withdrawal security systems and has revoked the affected address authorizations, Teng said. The exchange is also working with law enforcement and blockchain intelligence firms to trace and recover the stolen funds, while deposits remain unaffected.
Binance co-founder Yi He said deposits remained unaffected and continued to operate normally, while the exchange was working on enhancements to its withdrawal service and related address controls. It expects to begin resuming withdrawal services within the next 48 hours.
“We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified,” Binance said.
The announcement followed moves by several crypto firms, including Circle Internet Group, Tether and Ripple, to freeze funds tied to the hack.
Exploits are not uncommon in the crypto space. In 2025, Bybit suffered roughly $1.5 billion in losses due to a hack. More recently, Bitget lost more than $350 million worth of digital assets in a cyber theft incident. Over the past several years, bad actors have also drained billions of dollars in crypto from decentralized exchanges.
Bitcoin fell more than 4% to $77,994.96 on Friday as the hack weighed on crypto markets. Shares of Circle tumbled about 5% in after-hours trading on Thursday.
Circle CEO Jeremy Allaire said Thursday evening in a social media post that the company had frozen more than 800 million in USD Coin associated with the incident. USDT stablecoin issuer Tether CEO Paolo Ardoino also said in on X that his firm had frozen more than 1.5 billion of its stablecoin that may have been related to a potential breach.
Jack McDonald, Ripple’s senior vice president of stablecoins, said it was actively freezing affected funds held in RLUSD, its U.S. dollar-backed stablecoin.
