Binance is facing a major security crisis after more than $6.3bn (£4.7bn) in cryptocurrency was reportedly stolen in an attack that could rank as the largest hack in the sector’s history, sending prices lower and prompting an emergency suspension of deposits and withdrawals.
The exchange said an initial investigation pointed to a compromised laptop belonging to a DevOps engineer as the possible starting point for the breach. The incident raises fresh questions about the security of the infrastructure underpinning the global cryptocurrency market, where a single vulnerability can expose billions of dollars in digital assets.
Binance co-chief executive Richard Teng said the compromised device may have enabled an attacker to access a service container and submit unauthorised withdrawal transactions.
But he cautioned against treating the incident as a straightforward case of stolen employee credentials.
“The attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” Mr Teng said. “It involved a more complex attack process.”
He added that the investigation had not attributed responsibility to any individual and had found no evidence that wallet private keys had been leaked.
Binance has sought to reassure customers that their holdings are protected. The company said losses would be covered through its Secure Asset Fund for Users, known as SAFU, alongside corporate funds.
It has also worked with blockchain partners to freeze approximately $3bn in digital assets on-chain. Deposits and withdrawals have been temporarily suspended while the exchange carries out security checks, attempts to contain the breach and cooperates with law enforcement.
The incident nevertheless sent a shock through cryptocurrency markets. Bitcoin fell about 5 per cent to approximately $76,400 (£56,900), while Ether, Solana and XRP also declined. Stablecoin issuers Tether and Circle said they had frozen funds connected to the incident.
The episode is particularly significant for Binance, the exchange founded in 2017 by Changpeng Zhao, whose departure as chief executive followed his 2023 guilty plea to a felony related to failures to prevent money laundering on the platform.
Mr Zhao was sentenced under the US Bank Secrecy Act and later pardoned by President Donald Trump in 2025. He has also been linked to the Trump family’s cryptocurrency ventures.
Although he no longer manages Binance, Mr Zhao sought to reassure users, writing on X: “As a shareholder, I expect all user funds will be fully covered.”
The scale of the reported theft puts the exchange’s financial assurances and security response under intense scrutiny. Freezing assets may limit the damage, but cryptocurrency transactions can be difficult to reverse once funds move beyond the reach of exchanges and cooperating platforms.
For an industry still seeking to establish itself as a trusted part of the financial system, the incident is another reminder that technological sophistication does not eliminate operational risk. Binance’s ability to compensate customers and restore confidence will now be central to containing the fallout.
Commenting on this, Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, said, “For the public, the message is uncomfortable but important. Your crypto holdings, your investment portfolio, and your pension fund’s exposure to digital assets can all be materially affected by a security failure at an institution. When a cybersecurity incident sends shockwaves through crypto global markets, cybersecurity stops being a tech problem and starts being a systemic financial risk.”
Jayant Dave, APAC CISO at Check Point, added, “I’ve followed a lot of crypto thefts, and the Binance attack stands out less for the money than for how it was done. The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign. Binance’s early findings for now point to one compromised engineer’s laptop. From there, the attackers reached a service that could submit withdrawals, and billions moved within minutes. That’s the lesson: a strong vault doesn’t matter if someone controls the process that opens it.
Blockchain analysts have linked the attack to TraderTraitor, the North Korean state-backed group behind the 2025 Bybit theft. Governments haven’t confirmed that yet, but it fits a group that goes after people and processes, not cryptography. This attack isn’t a one-off either – five weeks ago, Bitget lost around USD 388 million the same way: keys untouched, control layer abused. Two major exchanges in just over a month is a trend we cannot ignore.
This goes well beyond crypto. Banks, payment providers, cloud platforms: any organisation whose automated systems move money or data on instruction carries the same risk. Attackers have learned that the shortest route to the crown jewels often runs through one employee’s laptop and a trusted internal service.
So, protect the people with the most access first. Treat developer and admin devices as high-value targets. Assume any machine or credential can be compromised and make sure none of them can move large sums without an independent check. Set hard limits on how much and how fast funds can move, and catch anomalies in seconds, not hours. Prevention has to come first, because once money spreads across multiple blockchains, getting it back is the exception.
Credit to Binance for freezing funds quickly and committing to cover customer losses. But the industry can’t keep relying on clean-up. The next attack will target the same weak point unless we close it first.”
Leave a Comment