$6.36 billion moved out of Binance wallets across 10 blockchains in roughly 20 minutes, according to blockchain intelligence firm TRM Labs, as reported by Reuters. That figure surpasses the 2025 Bybit theft, previously regarded as the largest known cryptocurrency heist on record.
Binance estimated its own impact at approximately $6.3 billion and temporarily suspended deposits and withdrawals while conducting security checks, according to the company’s official statement on X.
The Alleged Entry Point
Binance’s preliminary investigation identified a potentially compromised DevOps engineer’s laptop, though the company later noted additional points of breach.
Binance’s preliminary investigation pointed to a compromised DevOps engineer’s laptop as a likely entry point. Attackers may have used that access to reach a service container, then submitted unauthorized withdrawal transactions from there.
Binance said it found no evidence that private keys were leaked. Private keys are the cryptographic credentials that directly authorize control over cryptocurrency holdings, so their absence suggests attackers exploited an operational pathway rather than the most direct form of account control.
The alleged method raises questions about whether privileged employee devices and associated environments had excessive access to systems capable of authorizing withdrawals at this scale.
Attribution: Three Firms, Converging Assessments
TRM Labs, Elliptic, and Chainalysis each attributed the attack to North Korea, though those assessments rest on blockchain tracing and pattern analysis rather than a completed criminal indictment.
TRM Labs attributed the attack to TraderTraitor, describing it as an elite North Korean hacking unit. The firm said it reached that assessment with high confidence, according to Reuters.
Elliptic cited similarities between this fund movement and patterns seen in earlier attacks linked to the same network, according to the Wall Street Journal. Chainalysis also assessed the breach as likely conducted by TraderTraitor, according to CBS News.
Those assessments rest on blockchain tracing, infrastructure analysis, and attack-pattern comparison. No public criminal indictment has been filed in connection with this specific incident, and North Korean responsibility should be read as a converging set of private-sector assessments rather than a settled legal finding.
The alleged financial motive is consistent with longstanding assessments by U.S. government and international bodies that North Korean cyber operations generate hard currency for a heavily sanctioned state, including programs tied to weapons development.
Recovery Status
Roughly $3 billion of the affected assets have been frozen on-chain, while the remainder is still being traced across multiple blockchains.
Roughly $3 billion of the affected assets have been frozen on-chain through cooperation with blockchain partners, according to Binance’s statement. The remaining funds are still being traced, which complicates recovery efforts.
Binance said it revoked the affected address authorization and engaged law enforcement and blockchain intelligence partners. An updated proof of reserves is planned following remediation.
What Binance Says About Customer Funds
User funds are safe, Binance asserted, though that claim remains unverified pending a full technical post-mortem and updated proof of reserves.
User funds are safe, the company stated, and any losses will be covered through its Secure Asset Fund for Users and company reserves. That claim is a company assertion, not an independently verified finding.
A completed technical post-mortem and updated proof of reserves have not yet been published. Independent verification of customer-fund status remains pending.
A Question of Privilege Management
The reported entry point raises broader questions about whether large exchanges adequately separate deployment access from financial authorization.
The alleged breach path points to a structural question about privilege management at large exchanges. Deployment access and financial authorization are different functions, and the incident raises questions about whether controls separating those functions were sufficient.
Binance has not yet published a full technical post-mortem. Until it does, the complete picture of how this happened remains incomplete.
