Overview
Binance, one of the world's largest cryptocurrency exchanges, suspended customer withdrawals on Friday after attackers drained $6.3 billion from its platform in what the exchange described as the largest theft in the digital asset industry. In a public statement, Binance said it is coordinating with partners to freeze approximately $3 billion in assets connected to the breach and emphasized that user funds remain safe. The exchange also pledged to absorb all losses from its own reserves.
Operational response and timeline
Withdrawals were placed on hold temporarily while Binance conducts security checks. The company said it expects to reopen withdrawals by Sunday, pending completion of those checks. According to Binance, the intrusion was enabled by a compromised laptop belonging to a development and operations engineer. That compromise, the exchange said, allowed an unauthorized party to execute unauthorized withdrawals. Binance indicated investigators have found no evidence that any wallet private keys were exposed.
Blockchain analysis and attribution
U.S.-based blockchain analysis firms cited in reporting - TRM Labs and Chainalysis - characterized the bulk of the theft as occurring over a roughly 20-minute window late on Thursday. Both groups said the attacker appeared to exploit weaknesses in Binance's transaction authorization procedures. The two firms said they were confident the attack was likely carried out by North Korea's "elite hacking unit," referred to by the groups as "TraderTraitor."
Asset flows observed
On-chain data compiled by Glassnode showed large outflows from Binance: about $1.66 billion in the stablecoin USDT, $1.45 billion in Bitcoin, and $767 million in the stablecoin USDC. The analysis also noted that Ether and several smaller alternative tokens were removed from the exchange.
Stablecoin freezes
Operators of the major stablecoins took action to limit the movement of some of the stolen tokens. Circle, which operates USDC, said it had frozen over $800 million in USDC tied to the breach. Tether, operator of USDT, reported it froze over $1.567 billion in USDT associated with the incident.
Market reaction
Prices for major cryptocurrencies fell after reports of the attack. Bitcoin, the largest token by market value, extended earlier losses and was last down 3.2% at $77,484.10, after an initial dip to $76,518. Ether traded 3.7% lower at $2,235.94. Binance's native token BNB trimmed its earlier losses but remained down 5.5% from prior levels; data provider Glassnode said Binance's balance of BNB was left untouched by the heist.
Volatility spilled into equities tied to crypto exposure. U.S.-listed Coinbase and the Bitcoin-focused Strategy (MSTR) were each down more than 5% in premarket trading on Friday, while Robinhood shares dropped 6.3%.
Contextual notes
Binance reiterated that it will use its own funds to make users whole for any losses caused by the attack. The exchange is working with law enforcement and blockchain partners to trace and freeze assets tied to the incident.
Reporting credits
Additional reporting for aspects of the incident was contributed by other reporters.