Binance has said hackers stole cryptocurrency worth more than $6 billion in an attack that has prompted an international investigation and renewed concerns about the security of digital asset exchanges.
The company has reserved more than $6.34 billion of its own funds to cover the losses and is working with other blockchain organisations to locate and freeze stolen assets. Cybersecurity firms suspect a North Korean hacking group may have been responsible, although the attackers’ identities have not been confirmed.
What Happened During the Attack?
Blockchain intelligence firm TRM estimated that attackers transferred approximately $6.36 billion from Binance wallets across ten blockchains, most of it within around 20 minutes. Several cryptocurrency investigators have described the incident as the largest digital asset theft recorded.
Binance temporarily suspended withdrawals following the breach. The exchange said customer deposits remained unaffected and that it expected withdrawals to resume within a day or two. It also pledged to compensate users for losses arising from the attack.
Working alongside blockchain partners, the company said it had helped freeze roughly $3 billion in affected assets. Experts cautioned that other stolen funds were already being transferred or exchanged, potentially complicating recovery.
How Might Hackers Have Gained Access?
Binance co-chief executive Richard Teng said an initial investigation indicated the breach might have started with a compromised laptop belonging to a software engineer. Further examination, however, uncovered additional possible entry points into the company’s systems.
Investigators also found evidence of software apparently designed to erase traces of the intrusion. Teng said the attack involved coordinated activity rather than the actions of one individual, making reconstruction of events more difficult.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
The company has not established a definitive explanation for how the attackers obtained access to the affected funds.
Why Is North Korea Under Suspicion?
TRM attributed the theft to TraderTraitor, which it identifies as an elite North Korean hacking unit. Blockchain analysis company Chainalysis also said the incident appeared consistent with activity associated with that group.
The firms pointed to similarities with earlier cryptocurrency thefts. The FBI previously attributed a $1.5 billion attack on exchange Bybit to North Korea and linked it to TraderTraitor.
Binance has not publicly confirmed responsibility. Its spokesperson said the exchange was cooperating with law enforcement to identify those involved. US President Donald Trump said American officials were examining the incident.
What Security Weaknesses Are Being Examined?
The breach has raised questions about access permissions and approval controls for internet-connected cryptocurrency wallets, commonly called hot wallets.
Kok Tin Gan, a cybersecurity executive at NyxLab, suggested the incident could involve an unusually powerful access token that allowed extensive control of a Binance hot wallet. This remains an expert assessment rather than an established finding.
Teng confirmed that the affected assets were held in a hot wallet. He said the majority of Binance customer assets remained in cold wallets, which are kept offline and are intended to reduce exposure to online attacks.
What Happens to the Stolen Funds?
Investigators are tracing transfers across multiple blockchain networks. Analysts warned that criminals can move stolen cryptocurrency through intermediary wallets and conversion services to make it harder to follow.
The company said it was coordinating with token issuers, other exchanges and blockchain investigators to recover assets where possible. Although some funds have been frozen, the amount ultimately recoverable remains uncertain.
The420 Insight: What Does the Breach Mean?
The scale of the reported theft shows that even major cryptocurrency exchanges can face serious risks when attackers gain access to systems controlling digital assets. Binance’s promise to cover customer losses may limit immediate financial harm, but the attack raises pressing questions about wallet permissions, internal security and how quickly stolen cryptocurrency can be moved.
