Binance lost a record $6.3 billion in an attack that unfolded in about 20 minutes on Thursday, prompting rival crypto exchanges to strengthen their security systems. Executives are also urging stronger information-sharing across the industry as digital assets move deeper into mainstream finance. The scale of the loss, and the speed with which it played out, underscores the operational risks exchanges carry as digital assets become further embedded in the broader financial system.

The breach may have started with a compromised software engineer's laptop, and social engineering is suspected. Tether froze nearly $1.57 billion and Circle froze $800 million of funds linked to the attack.

Rival Exchanges Tighten Their Defenses

Coinbase said it adjusted the systems that store its cryptocurrency keys offline — a setup known as cold storage, designed to keep keys out of reach of internet-based attackers. The company said it made the changes "solely out of an abundance of caution." The move comes as President Donald Trump's regulators promote deeper integration of digital assets into the financial system.

Kraken said it is monitoring industry incidents for lessons it can apply to its own defenses. A spokesperson added, "Full-time teams at Kraken look for potential vulnerabilities every day."

Franklin Templeton's head of crypto, Chris Perkins, also weighed in, urging swift action. "For crypto to reach its full potential, the security situation must be addressed immediately," Perkins said.

Meanwhile, Binance, the world's largest crypto exchange, halted withdrawals after the attack. Analysts blamed North Korea, which routinely denies involvement in crypto thefts. North Korea's mission in Geneva did not respond to requests for comment.

Binance said it would use company funds to cover the losses. However, GSR's Josh Riezman said, "Our expectation is the industry writ large will actually not suffer material losses." Executives also expressed confidence that Binance has enough resources to cover the damage.

How the Attack Unfolded

Binance co-CEO Richard Teng described the incident as a "complex attack" in a post on X. He said it may have begun with a compromised software engineer's laptop. That access gave hackers entry to systems used to process withdrawals.

The company later found additional breaches beyond the initial entry point. Software designed to erase traces of the attack hampered the investigation.

According to blockchain analytics firms TRM Labs and Chainalysis, most of the theft unfolded in about 20 minutes late on Thursday. The attack resembled earlier incidents blamed on North Korea. Security experts said social engineering may have been used to compromise the laptop. In such attacks, hackers race to launder the funds before an exchange detects the breach — a dynamic that makes rapid detection and freezing central to any recovery effort.

Freezes and Calls for Real-Time Coordination

Tether's freeze covered nearly $1.57 billion in funds tied to Binance, while Circle locked $800 million. Those measures stand in contrast to bitcoin and ether, which cannot be frozen because no single entity controls them.

Circuit CEO Harry Donnelly said companies are planning more employee training against social engineering. In a post on X, OKX CEO Star Xu said, "We need a real-time alert system." He said participants should share information immediately when a hack occurs so that suspected stolen funds can be frozen more quickly. Riezman added that the incident "will be a catalyst for that." Whether those calls harden into a functioning, industry-wide alert system — and how much of the stolen funds can ultimately be frozen or recovered — remains an open question.

Market Reaction

Bitcoin fell over 4% on Thursday and ether dropped over 5%, though both recovered some ground on Friday.