Binance Hack: Are Funds Safu? What We Know So Far About The Biggest Heist In Crypto History

What Happened

Cryptocurrency giant Binance faces what could be the largest exchange hack in history after a security breach affected an estimated $6.3 billion in digital assets, eclipsing the record-setting $1.5Bn Bybit exploit in 2025. The Binance hack has led the exchange to pledge to cover all losses, while investigators work to identify the attackers and recover the stolen funds.

Compromised Engineer’s Laptop Suspected in the Binance Hack

Binance’s preliminary investigation indicates the attack may have originated from a DevOps engineer’s compromised laptop. This breach may have allowed attackers to access a service container, which they used to submit unauthorized withdrawal transactions.

However, Teng cautioned against viewing this incident as merely a case of stolen employee credentials. He noted that the attacker did not exploit just one engineer’s permissions or carry out a single action.

Binance plans to publish a detailed technical post-mortem once it completes its investigation, along with an updated Proof of Reserves following the security remediation process.

North Korean Hackers Suspected, but Attribution Remains Unconfirmed

The identity of those responsible for the Binance hack remains uncertain, although two prominent cryptocurrency analytics firms have independently linked the incident to North Korean cybercriminals.

Both TRM Labs and Chainalysis have pointed to a North Korean hacking operation known as TraderTraitor. Chainalysis reportedly expressed high confidence in the group’s involvement, while TRM Labs identified similarities between the Binance incident and previous attacks attributed to North Korean-linked hackers.

On-chain sleuth ZachXBT also claims that TraderTraitor is responsible, linking wallet addresses from the Binance hack to those from the $388M Bitget exploit earlier this month.

Zach adds that after the Arbitrum Security Council froze $30M in stolen funds, the total amount frozen from the $6.3Bn hack sits at $2.83Bn. Tether, Circle, and Ripple account for most of it.

Binance has not confirmed these allegations and says it is working with law enforcement to identify the perpetrators. The suspected involvement of North Korean hackers is particularly significant given the country’s history of targeting cryptocurrency exchanges and digital asset platforms to generate funds.

The most recent major example was the February 2025 attack on Bybit, when hackers believed to be operating under the Lazarus Group stole about $1.5Bn in digital assets.

Bitcoin also came under pressure following news of the breach, falling by more than 4% as markets reacted to the security concerns. It remains unclear whether the incident will have a lasting impact on investor confidence or broader cryptocurrency market sentiment.

Binance Hack: What Does the Incident Mean for the World’s Largest Exchange?

Market Context

The exchange also temporarily suspended withdrawals while undertaking a security overhaul of its withdrawal infrastructure and associated addresses. Deposits, however, remain unaffected and operational.

Instead, he described the incident as a more sophisticated, multi-stage attack. Binance has also emphasized that it has no evidence that any wallet private keys were exposed.

Why It Matters

Binance confirmed that the incident affected approximately $6.3Bn in digital assets, with around $3Bn reportedly frozen on-chain through coordination with blockchain partners and other platforms. However, a substantial portion of the funds may remain under the attackers’ control.

In a statement, Binance co-CEO Richard Teng reassured customers that their funds were safe and that the company would absorb the financial impact using its Secure Asset Fund for Users (SAFU) and corporate reserves. Former CEO CZ also spoke on the incident, saying on X, “User funds are safe..I don’t manage Binance anymore, but as a shareholder, I expect all user funds will be fully covered.”

Details

The exchange has revoked authorizations for affected addresses and engaged law enforcement agencies and blockchain intelligence specialists to trace transactions and recover assets.

Within roughly two weeks, the attackers had converted at least $300M into unrecoverable funds. By August 2026, Bybit co-founder and CEO Ben Zhou said the exchange had recovered approximately $48.4M, with another $30.5M frozen.

Other Crypto Platforms Freeze Billions in Assets

As ZachXBT documented, the scale of the Binance incident has prompted action across the wider cryptocurrency industry. Stablecoin issuers Tether and Circle have reportedly frozen about $2.83Bn in assets to prevent further movement of potentially compromised funds.

These interventions highlight the importance of centralized stablecoin issuers and blockchain analytics firms in responding to major cryptocurrency security incidents, particularly when stolen assets move across multiple networks and platforms.

Explore: The Best Token Presales