The crypto world is reeling after a hacker drained billions of dollars from Binance, the world's largest digital currency exchange, on Thursday. Full details of the breach are still emerging, but the broad strokes are becoming clearer as everyone from security researchers to Elon Musk to the company itself weighs in with theories.

In a post on X late Thursday evening Eastern Time, Binance said a compromised developer laptop was likely to blame for the catastrophe, which stands as by far the biggest security incident in an industry that has been plagued by hacking since its earliest days. The company plans to provide more extensive details on Friday, and in the meantime, many other major crypto firms—including its biggest rivals—have rushed in to aid Binance. Here is a detailed look at what is known so far about the nature and scope of the hack, and what is likely to happen next.

How did Binance get hacked?

Reports of a hack began surfacing on X early on Thursday afternoon. That is when crypto observers, referring to public blockchain data, pointed to large amounts of currency moving out of wallets associated with Binance. Soon after, company cofounder Changpeng Zhao confirmed the hack.

In its post on Thursday evening, Binance stated that the hacker appeared to have gained control of a laptop belonging to an employee or a contractor. The company wrote that the "initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." If that assessment holds, the breach would represent a failure of operational security—the protection of employee devices and internal systems with withdrawal privileges—long regarded as one of the industry's most stubborn weak points, even at its largest firms.

How much did the hacker steal?

Reports on X have suggested the hacker made off with anywhere from $2 billion to $8 billion, but Binance said in its post that the estimated total impact sits at around $6.3 billion. The situation is still fluid, and it could be days before the scope of the hack is finally determined. For scale, the largest previously recorded crypto theft—the roughly $1.5 billion hack of exchange Bybit in February 2025—was less than a quarter the size of Binance's estimated loss.

What currencies did the hacker steal?

Early reports say the hacker took $1.5 billion in Bitcoin and around the same amount in the stablecoin Tether, along with slightly under $1 billion worth each of Ethereum and the USDC stablecoin. It is likely the hacker stole various other currencies as well.

Who is behind the hack?

No one has claimed responsibility for the hack, and Binance has not pointed to a specific culprit, but security firm TRM and others have said North Korea is almost certainly behind it. The theory is highly plausible, given that the North Korean military has long used crypto hacking to help fund its operations. U.S. authorities, including the FBI, have previously attributed a series of major thefts to North Korea-linked groups such as the Lazarus Group—among them the 2022 Ronin Bridge breach and the 2025 Bybit hack—a track record that gives the TRM assessment considerable precedent. The sophisticated nature of the hack, which included efforts to move the funds after they were stolen, is also consistent with North Korean tactics. For now, though, there is no definitive proof that the country is responsible.

Are the funds gone for good?

Soon after news of the hack became public, Tether and Circle—the firms responsible for minting USDT and USDC, respectively—announced they would freeze any stablecoins tied to the hack. While this is ostensibly good news, other reports indicate these efforts may only be partially successful at best. That is because there is evidence the hacker immediately took the stolen funds to the online crypto lending platform Aave and posted them as collateral for a loan in Ethereum, leaving the hacker positioned to walk off with the borrowed Ether.

What has been the impact on crypto markets?

Unsurprisingly, the price of all major cryptocurrencies fell upon news of the hack, though the drop was not dramatic. Bitcoin and Ethereum were down around 3% as of early Friday, but that decline also coincided with a selloff in the broader financial markets. The relatively muted reaction suggests the market is confident that Binance has deep enough pockets to absorb the loss while keeping its customers whole. Binance, for its part, maintains a dedicated emergency insurance reserve known as the Secure Asset Fund for Users (SAFU), created in 2018 and funded by a portion of trading fees; the exchange used it to reimburse customers after a 2019 breach in which some 7,000 Bitcoin were stolen.

What have been the reactions to the hack?

In the immediate wake of the breach, the CEOs of Coinbase, Tether, and other major crypto companies pledged to support Binance in its hour of need. In response, Binance's cofounder noted that "many industry friends and even competitors (including some previously-not-so-friendly ones) provided very much needed help." Zhao also expressed thanks to Yi He, the company's current co-CEO, for pulling an all-nighter while she is pregnant.

Meanwhile, some on X expressed incredulity that Binance's security could be so flawed as to allow a hacker to steal billions simply by gaining access to a single company laptop. Elon Musk chimed in with an AI-focused take, saying, "Super intelligence agents will at some point do this to gain currency for themselves, not a human."

This story was originally featured on Fortune.com.