The crypto firm Binance has suffered a $6.3 billion loss in what experts believe to be the biggest crypto hack ever.

Binance is best known as the world’s largest crypto exchange by trading volume. It has more than 335 million registered users and held about $160bn in assets under custody at the time of its 2024 annual report.

Hackers have drained an estimated $6.3bn from Binance wallets, the exchange said.

The attack took place on Thursday. On Friday, Binance said its investigation had found “additional points of breach” beyond the compromised laptop it first blamed.

The incident could be the largest crypto heist ever, Reuters reported. Binance says about $3bn of the affected assets has been frozen.

em360tech image

What Happened

The attackers drained Binance hot wallets on nine blockchains in under three hours on Thursday, between 4:10pm and 7:05pm ET, according to blockchain analytics firm Arkham.

Arkham put the haul at $6.01bn, slightly below Binance’s own $6.3bn estimate.

Most of the stolen funds are in major cryptocurrencies. By Friday morning, the attacker held around 18,270 BTC, 488,364 ETH, 663.6 million TRX and 970,551 SOL, Decrypt reported, citing Arkham data.

A large share of the haul went into a single receiving wallet. Tether and Circle froze about 975.1 million USDT and 823 million USDC there, roughly $1.8bn between them.

The attacker is already on the move. Early on Friday, they shifted about $38.82m in ETH to a new address, while still holding about $1.12bn in ETH. A linked Tron address also sent about $2.1m in TRX to nine new addresses.

Arkham says around $2.9bn of the stolen funds could still be moved.

How Binance Responded

Binance suspended deposits and withdrawals, revoked the affected address authorisation, and is working with law enforcement and blockchain intelligence firms to trace the funds, according to Decrypt. Deposits have since reopened, but withdrawals remain paused.

Reuters reported that Binance also paused its Binance Alpha platform as a precaution.

How the Attackers Got In

Binance’s first explanation was a compromised DevOps engineer’s laptop. According to Decrypt, the company said this may have given an attacker access to a service container and let them submit unauthorised withdrawals. Binance said it found no evidence of a wallet private key leak.

CEO Richard Teng said the attacker did not simply use one engineer’s permissions. He described it as a more complex process than a single “one-click” action.

Binance has not published a full technical account. Teng said a detailed post-mortem will follow once the investigation is complete and every fact is verified.

Who Is To Blame?

Two analytics firms have attributed the attack to a North Korean hacking unit called TraderTraitor. Cybersecurity firm Check Point said the unit is also known as Lazarus Group, which has been blamed for the 2025 Bybit hack. Chainalysis said it has “high confidence” in the link.

Binance has not made that attribution. Teng said its investigation has not pointed to any individual. Co-founder Changpeng Zhao, who no longer runs the company, said the incident “looked like a hack”, according to Reuters.