The hack of Binance, estimated at USD 6.3 billion in nominal terms, is the largest attack in crypto history and more than four times the size of Bybit's previous record. In response, the exchange suspended withdrawals and said it plans to cover all losses itself.

Binance operates a centralized crypto exchange that combines trading in digital assets with custody of customer funds. Unlike with decentralized protocols, customer deposits sit in wallets that the company controls itself. In 2023, the platform pleaded guilty in the US to violating anti-money laundering rules and paid a penalty of USD 4.3 billion. Founder Changpeng Zhao stepped down; in 2025, the US president pardoned him.

The exchange had already lost around 7,000 BTC in 2019 in a hack of a hot wallet — an internet-connected wallet, in contrast to offline cold storage — when the coins were worth about USD 40 million. Its emergency fund, SAFU (Secure Asset Fund for Users), covered the damage in full at the time. However, Binance describes the current figure of USD 6.3 billion as an estimate of the impact rather than a confirmed amount stolen. On-chain, analytics firm Arkham has also linked nearly USD 6 billion in Bitcoin, Ether, Solana, and stablecoins to 55 addresses.

The Binance Hack Exceeds Bybit by a Factor of 4.2

The previous record belonged to Bybit. In February 2025, attackers took around USD 1.5 billion in Ether from one of its cold wallets, making the Binance estimate around 4.2 times as high. At Bybit, the entry point was a compromised software supply chain at SafeWallet. A few days later, the FBI attributed the attack to North Korea and referred to the activity as TraderTraitor.

In total, attackers stole around USD 2.9 billion in about 150 attacks in 2025, according to data from TRM Labs. The damage at Binance alone is thus more than twice this annual total. By comparison, the next-largest cases, such as Ronin, Poly Network, and Coincheck, look small at around USD 530 to 620 million.

Several of the major cases hit blockchain protocols rather than exchanges. In March 2022, funds worth almost USD 620 million flowed out of Ronin, the blockchain behind the game Axie Infinity, and the US Treasury Department held North Korea's Lazarus Group responsible. At Poly Network, a vulnerability between several blockchains cost around USD 610 million in August 2021, though the attackers returned almost all of the loot. The BNB Chain exploit in October 2022 falls into the same range, at around USD 570 million in nominal terms, although Binance founder Zhao estimated the outflow at only around USD 100 million at the time. Wormhole lost around USD 320 million in February 2022; Jump Crypto, the crypto arm of Jump Trading, later replaced the funds.

Among exchanges, Coincheck lost around USD 530 million in the cryptocurrency NEM from a hot wallet in January 2018. Bitget reported an outflow of more than USD 350 million from hot and warm wallets as recently as September 2026. Mt. Gox put its losses at around 850,000 BTC, which disappeared between 2011 and 2014 and were worth around USD 450 to 500 million at the time. The exchange eventually filed for bankruptcy in early 2014 and shortly afterwards found around 200,000 BTC in an old wallet.

All amounts cited reflect dollar values at the time, so the comparison is only nominal. Valued at today's Bitcoin prices, the bankrupt exchange's loss would be many times higher than the Binance estimate. Bybit, Coincheck, Bitget, and Mt. Gox also operated as centralized exchanges, yet none of them lost nearly as much as Binance in nominal terms.

A Compromised Laptop as Possible Entry Point

According to initial findings, a DevOps engineer's compromised laptop may have given the attackers access to a service container — an isolated software environment in which individual services of the platform run. From there, the attackers were presumably able to trigger unauthorized withdrawals. It remains unclear how they took over the computer.

Binance said it found no evidence of a leak of the wallets' private keys. The exchange revoked the affected address's authorization and brought in law enforcement and blockchain analytics firms. It also announced a detailed technical analysis of the failure and an updated proof of reserves, the attestation exchanges use to demonstrate that they actually hold the customer funds they claim.

TRM Labs attributes the attack with high confidence to the North Korean group TraderTraitor, which was previously behind the Bybit hack. Chainalysis, too, sees North Korea as the likely perpetrator with high confidence. As evidence, the firm points out that the funds were mixed with the loot from the Bitget hack in September. In that attack, Bitget CEO Gracy Chen had likewise named North Korea as the very likely perpetrator. Nevertheless, both attributions in the Binance hack remain assessments by private analytics firms. So far, no finding by authorities has emerged, as it did in the Bybit case.

Notably, the attacker put part of the loot back to work. They deposited 60 million USDT with the decentralized lending protocol Aave — a service where users deposit assets as collateral and borrow against them — and borrowed around USD 44.6 million in Wrapped Ether against this collateral. Aave then restricted the affected markets.

Moreover, the exact amount of the damage remains open. Chainalysis first put it at a minimum of USD 5.9 billion, then at USD 6.4 billion. The more recent figure is slightly above Binance's own estimate.

How Much Binance Has Already Frozen

Binance puts the funds located or frozen so far at around USD 3 billion, although in a post on X the exchange cited USD 2.54 billion as the verified frozen amount. Stablecoin issuers blocked the largest share: because they issue the tokens, they can block individual addresses. Tether froze around USD 1.57 billion and Circle around USD 823 million, meaning the two issuers together account for around USD 2.4 billion. Tether CEO Paolo Ardoino and Circle CEO Jeremy Allaire confirmed the freezes. In addition, Ripple stopped around USD 200 million in its stablecoin RLUSD, according to Binance co-founder Yi He.

As a result, around USD 3.3 billion remains unaccounted for. Initially, there was no new information on the whereabouts of this sum, making it — along with the promised technical analysis and the updated proof of reserves — one of the incident's central open questions. Binance plans to cover the losses from the SAFU fund and from company funds. By comparison, the total damage is more than 100 times the 2019 loss.

"Binance will cover all hacking losses." — Yi He, co-founder of Binance

Withdrawals remain suspended until further notice, meaning customers cannot move funds off the platform in the meantime. The exchange has also paused trading on Binance Alpha and has held out the prospect of a restart within 48 hours, though it made no firm commitment.

Bitcoin, BNB, and Crypto Stocks Decline

Crypto markets reacted to the incident with losses. In the hours after the news, Bitcoin fell to a six-week low and Ether to a two-month low, with the size of the drop depending on the point of measurement. By contrast, BNB, the token of the Binance ecosystem, fell much more sharply, as its utility depends heavily on the platform.

On Wall Street, crypto-related stocks, including Coinbase and Strategy, came under pressure in after-hours trading. Shares of Circle, the issuer of the stablecoin USDC, also declined; the company had itself frozen part of the loot beforehand. Overall, the declines in BNB and the crypto stocks were mostly steeper than in Bitcoin and Ether.