Binance says hackers stole more than $6 billion in crypto in what would be the largest heist on record

Binance says attackers moved more than $6 billion in digital assets out of its wallets in a breach that it says began with a single engineer’s laptop. For PSPs and other high-risk payment providers, the detail that matters is not just the size of the loss, but how quickly a compromised endpoint turned into unauthorized withdrawals across multiple chains.

1. In a post on X, Binance said the attackers gained access to its network by compromising one engineer’s laptop, then moved into a service container and initiated unauthorized withdrawals. The company said the criminals used 50 pre-signed authorizations they had prepared in advance to execute the transactions.
2. The breach affected wallets across the XRP Ledger, Ethereum, Bitcoin, Tron, and Solana networks. Binance said a second wave of attacks targeted wallets on Avalanche and Polygon, which gives a useful read on how broad the blast radius can be once wallet infrastructure is exposed.
3. Binance said roughly half of the stolen assets were frozen as they moved across different blockchains. It also said its private keys were not compromised, which matters operationally: if private keys had been exposed, the attackers could have gained near-total control over the company’s crypto holdings.
4. According to Binance’s 2025 annual report, the exchange holds more than $160 billion in digital assets in custody. Binance said it will make all customer funds whole, has suspended withdrawals, and expects to restore the service within 48 hours of the breach.
5. Blockchain analysis firm TRM attributed the attack to TraderTraitor, a North Korean hacking group. The FBI identified the same group as responsible for the $1.5 billion theft from Bybit in February 2025, which previously held the record for the largest cryptocurrency heist. TraderTraitor is a subgroup of the Lazarus Group, which is believed to be sponsored by the North Korean government.

TRM has also linked TraderTraitor to a breach at Bitget, where more than $350 million in digital assets were transferred without authorization. That attack reportedly followed a similar pattern, with criminals compromising a critical backend system within Bitget’s wallet infrastructure.