The largest cryptocurrency heist on record, totaling $6.3 billion, may have originated from a compromised DevOps engineer's laptop, according to Binance's initial investigation. The breach allowed an attacker to submit unauthorized withdrawal transactions, impacting a range of cryptocurrencies including Ethereum, Bitcoin, Solana, and XRP.
Binance has managed to freeze approximately $3 billion of the stolen assets, leaving $3.3 billion still unaccounted for. The exchange has confirmed that it will cover all user losses through its SAFU fund and company reserves, as stated by founder Changpeng Zhao. The company has temporarily suspended deposits and withdrawals while security checks are completed, revoked the affected address authorization, and engaged law enforcement and blockchain intelligence partners to trace and recover the funds.
Experts suggest the attack did not involve breaking encryption or stealing private keys. Instead, the attacker gained control over the system responsible for authorizing transactions. "The attackers didn't break the encryption or steal the private keys. They took over the system that tells the keys what to sign," Jayant Dave from Check Point told BBC News.
Blockchain intelligence firm TRM points to the North Korean state-sponsored hacking group, TraderTraitor, as a likely culprit, citing the group's alleged involvement in the $1.5 billion Bybit hack in February 2025. TRM's analysis suggests the incident may have involved the misuse of a hot wallet—a wallet connected to the internet used by exchanges for customer withdrawals. While early reports indicated a phishing attack for authorizations, subsequent thefts across multiple chains with different keys indicate a deeper level of access. TRM states that a single actor obtained valid signatures for wallets on ten chains within hours.
Emily Taylor, co-founder of the Global Signal Exchange, described the hack as occurring "on a speed and scale we've never seen." Binance has not officially confirmed the identity of the hackers but is working with law enforcement agencies.