Binance Hit by Record $6.3B Crypto Heist via One Laptop

What happened: a laptop, a container, one transaction

Binance disclosed Thursday that a security incident hit roughly $6.3 billion in assets, with initial investigation pointing to a compromised DevOps engineer's laptop that let an attacker access a service container and submit unauthorized withdrawal transactions.

The company said there is no evidence of a wallet private key leak.

According to The Hacker News, at 20:20 UTC an operator submitted a transaction containing 50 pre-signed authorizations aimed at the hot wallet; one matched, and 3 minutes 24 seconds later a single transaction moved the wallet's entire balance — 167,464 ETH and 63 tokens including 1.615 billion USDT — to an attacker-controlled address.

Why it's the record — and who did it

The breach dwarfs the previous record: the $1.5 billion North Korean theft from Bybit in February 2025.

The Hacker News reports TRM Labs attributed the attack to North Korea's TraderTraitor group with high confidence, citing telltale signs — small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst.

The Hacker News also reports Chainalysis currently estimates the amount stolen at approximately $5.912 billion at time of theft, nearly four times the next-largest crypto heist.

The freeze: Tether, Circle and $3 billion locked

Binance has suspended all deposits and withdrawals and revoked the affected address authorization, saying it expects withdrawals to resume within 48 hours after a security revamp of the withdrawal service.

Tether froze more than $1.567 billion of its digital currency, CEO Paolo Ardoino said on X, while Circle's CEO Jeremy Allaire said Circle froze hundreds of millions more and was coordinating with law enforcement.

Together with Ripple and World Liberty Financial, roughly $2.67 billion in stablecoins has been frozen, and the Arbitrum Security Council froze about $30 million in ETH and ARB.

Binance says about $3 billion has been frozen on-chain so far, and it will cover all losses from its SAFU fund and company funds, insisting user funds are safe.

The stakes: a $2.3 billion gap and a lingering attacker

Even with the freeze, substantial assets remain at large. The Hacker News reports the attacker still controls more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, plus smaller amounts on other chains.

Hindustan Times, citing a FinanceFeeds report, notes the SAFU fund holds about $1 billion in Bitcoin, leaving a roughly $2.3 billion gap likely to come from Binance's corporate balance sheet. Bitcoin fell about 4.3% and Ethereum 4.6% as word spread, according to NBC News.

Because exchange funds are not automatically insured like bank deposits, refunds depend on the company's pledge. Binance has promised a detailed technical post-mortem, an updated Proof of Reserves after remediation, and continued work with law enforcement to identify the criminals.

Founder Changpeng Zhao said, 'As a shareholder, I expect all user funds will be fully covered.'

Sources

This one wasn’t built for you. The next one is.

Nobody wrote this. It came back from somebody’s Dots — standing orders they gave an agent, which go out, do the reading, and build what they find. Theirs are pointed at what they care about. Yours would be pointed at you.

Build your Dots. A market, a field, a question — anything you want to get good at.
They go. Research across the web and your accounts, checked against the sources.
They keep going. When something changes, your page updates and you hear about it.

Get ShareDot Browse more stories →