Binance investigates $6.3 billion cyberattack

Binance reported it was investigating a potential security issue on Thursday ^[3][11]. The exchange confirmed that a "complex attack" resulted in an estimated loss of $6.3 billion in digital assets ^[6].

The company's internal communication initially varied. A Binance spokesperson said the company's teams were aware of reports of a potential security issue and stated user funds were "completely safe" ^[6]. However, co-founder Changpeng Zhao was more direct, writing on X that "It does look like a hack on Binance" ^[6].

Binance initially suspended withdrawals on multiple networks, later extending the suspension to all deposits and withdrawals across every network it serves ^[6]. The company later stated it expected withdrawals to resume within 45 to 48 hours ^[6][9].

Rapid execution and compromised laptop

The attack was characterized by its speed and breadth. The perpetrators targeted wallets across 10 different blockchain networks and moved the majority of the funds in approximately 20 minutes ^[2][6].

Binance's preliminary investigation indicates the breach may have started with a compromised laptop belonging to a DevOps engineer ^[1][2]. Binance said its initial investigation pointed to a compromised laptop, but subsequent findings revealed additional points of intrusion ^[8].

Despite the breach, Binance reported it has found no evidence that wallet private keys were leaked ^[2][8].

Attribution to North Korean cyber units

Blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack to hackers linked to North Korea ^[1][2]. Binance has not officially attributed the attack to any specific actor ^[6].

TRM Labs reported that the breach mirrored previous North Korean heists ^[6]. Specifically, the firm noted similarities to a February 2025 attack on the Bybit exchange, where $1.5 billion was stolen in an incident the FBI linked to Pyongyang ^[2][6].

The scale of the theft has led some experts to warn of a shift in threat capabilities. Eric Schiffer, chairman of Patriarch and Reputation Management Consultants, said, "I think the bloodbath of AI hacking is to come" ^[8].

Recovery efforts and market impact

Binance has pledged to cover all customer losses using company funds and its Secure Asset Fund for Users (SAFU) ^[1][2]. The exchange has reserved over $6.34 billion to cover the impact, which includes $5 billion already held in the same cryptocurrencies that were stolen ^[8].

Recovery efforts are ongoing with the help of blockchain partners and stablecoin issuers ^[1][6]. Approximately $3 billion in affected assets have already been frozen on-chain ^[1][2]. Tether, the issuer of the USDT stablecoin, specifically froze more than $1.567 billion of its tokens connected to the breach ^[6].

The news caused immediate volatility in the markets. Bitcoin dropped more than 3% to a six-week low, falling below $79,000 ^[2][9]. Other assets also declined, with Ether falling more than 3% and the BNB token dropping 5% ^[9].

What we don't know

• Has the North Korean government officially denied or acknowledged the attack?
• What specific "additional points of intrusion" were discovered beyond the engineer's laptop?
• Will the recovery of the $3 billion in frozen assets be completed successfully?