Cryptocurrency giant Binance said on Thursday that a “security incident” on its platform has impacted about $6.3 billion worth of assets.
The world’s biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.
Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million USDT related to the incident, respectively. The Arbitrum Security Council is said to have executed a transaction to freeze about $30.5 million from the Binance Exploit.
“Initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” Binance said in an update.
The company said there is no evidence of a wallet private key leak, adding it will cover all losses from the Secure Asset Fund for Users (SAFU) fund and its own funds.
Out of an abundance of caution, Binance has also taken the following steps –
- Temporarily suspended deposits and withdrawals while security checks are completed
- Revoked the affected address authorization;
- Engaged law enforcement and blockchain intelligence partners to trace and recover funds
“We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice,” Binance said.
In an update, Binance said it expects withdrawals to resume in 48 hours, after its team “completes a security revamp of the withdrawal service and its related addresses.”
The development makes it the biggest cryptocurrency heist recorded to date, surpassing the theft of about $1.5 billion from Bybit in February 2025. The incident was subsequently attributed to North Korea.
“Our current estimate on the amount stolen is approximately $5.912 billion at time of theft, nearly 4x the amount stolen in the next largest crypto heist,” blockchain intelligence firm Chainalysis said in an X post.
Attributed to North Korea’s TraderTraitor
TRM Labs has attributed the record-breaking hack targeting Binance to threat actors from North Korea with high confidence. The blockchain analytics company attributed the attack to TraderTraitor, which was also behind the 2025 Bybit heist.
“Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst,” TRM Labs said.
“The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit.”
TRM Labs said preparation for the attack was underway at least 36 hours before the theft, with the attackers taking over a Binance hot wallet to send its “entire balance to an attacker-controlled address” –
At 20:20 UTC, the operator submitted a single transaction containing 50 authorizations. Each was signed by the Binance hot wallet, and each pointed it to a sweeper contract that accepts instructions only from the operator. Every wallet keeps a running count of its transactions, called a nonce, and an authorization works only at the count the wallet has reached at the moment it executes. The Binance hot wallet processes a steady flow of withdrawals, so its count keeps moving forward. By preparing signatures for 50 consecutive counts, the attacker guaranteed that one would still be valid when the transaction executed. One matched, which was all the attacker needed. The signatures were produced in advance as a batch.
Three minutes and 24 seconds after the delegation, the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
The most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains. The batch of 50 pre-signed authorizations suggests the access may have been limited in time, or that signatures had to be requested through a system. Binance has yet to publish a root cause.
So far, Tether, Circle, Ripple, and World Liberty Financial have frozen about $2.67 billion in stablecoins, and Arbitrum’s Security Council has frozen about $30 million in ETH and ARB. The attacker continues to retain control of more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, plus smaller amounts on other chains.
