Binance absorbs record $6.3B North Korean hack, pledges full user compensation

Key points

• Binance confirmed a $6.3 billion breach, the largest crypto theft on record, surpassing the 2025 Bybit incident.
• Co-CEO Richard Teng stated the exchange will cover all losses via its Secure Asset Fund for Users, assuring customers their assets are safe.
• Withdrawals were suspended but are expected to resume within 48 hours; deposits remained unaffected during the incident.
• Blockchain firms TRM Labs and Elliptic attributed the attack to the North Korean group TraderTraitor with high confidence.
• Stablecoin issuers Tether and Circle froze over $2.3 billion in assets to prevent further movement of stolen funds.

Background

This incident follows a pattern of major crypto exchange breaches, such as the $1.5 billion Bybit hack in February 2025, which was also linked to North Korean actors. North Korea has increasingly relied on cyber theft to generate foreign currency amid UN sanctions. Binance founder Changpeng Zhao, who was pardoned by President Trump in 2025, publicly stated that user funds are safe despite no longer managing the company.

How outlets are covering it

While Yahoo Finance and NPR agree on the $6.3 billion figure and the North Korean attribution, they differ on technical details. Yahoo Finance notes the attack involved a self-destruct mechanism that destroyed digital tracers, complicating the investigation. NPR highlights cybersecurity expert Kok Tin Gan’s view that the breach may have involved a single signature granting full access to a hot wallet, raising questions about approval controls. Both sources confirm that Binance found no evidence of leaked private keys, but Yahoo Finance emphasizes the 'complex' nature of the breach beyond a single compromised laptop.

Why it matters

The breach triggered a sharp market sell-off, with Bitcoin falling 5% to $77,000 and crypto-related stocks like Coinbase and Robinhood dropping up to 14%. Despite the massive theft, analysts note it does not currently appear to be a solvency event for Binance, reducing the risk of a broader financial feedback loop. The incident underscores ongoing vulnerabilities in crypto exchange security and the persistent threat posed by state-sponsored hacking groups.

What to watch

Binance expects to resume customer withdrawals within 48 hours. The company is conducting a deeper investigation into the breach, which may have started with a compromised engineer's laptop but involved broader security failures. Law enforcement partners are working to confirm the identity of the criminals, while stablecoin issuers continue to freeze assets to limit the attackers' ability to move funds.