Binance said Friday that a security incident impacted about $6.3 billion in client assets, with around $3 billion frozen on-chain, marking the largest crypto hack on record.
The company later added it began recovering assets impacted by the breach after pledging to cover losses using its Secure Asset Fund for Users, which the company created in 2018 as a protection for clients in the event of a hack.
It wasn’t clear how the attack took place. The world’s largest crypto exchange initially said the hack may involve “a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” However, Co-CEO Richard Teng later said the attack involved a more complex process rather than the misuse of a single engineer’s permissions.
The FBI said Friday it was aware of the incident and was in touch with “relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps.”
It wasn’t clear either who was responsible for the breach. But TRM Labs, a blockchain intelligence and AI investigations company, pointed to North Korean hackers as the potential culprits. “Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst,” the company said in a post.
Blockchain data platform Chainalysis also said this appears “be the work of North Korean cybercrime group TraderTraitor. This group has repeatedly targeted the cryptocurrency industry, exchanges, DeFi protocols, and investors, to raise funds for the regime. We base our intelligence assessment on on-chain activity observed in the hours following the hack.”
Binance temporarily suspended withdrawals while it overhauls its withdrawal security systems and has revoked the affected address authorizations, Teng said. The exchange is also working with law enforcement and blockchain intelligence firms to trace and recover the stolen funds, while deposits remain unaffected.
Binance co-founder Yi He said deposits remained unaffected and continued to operate normally, while the exchange was working on enhancements to its withdrawal service and related address controls. It expects to begin resuming withdrawal services within the next 48 hours.
“We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified,” Binance said.
The announcement followed moves by several crypto firms, including Circle Internet Group, Tether and Ripple, to freeze funds tied to the hack.
Exploits are not uncommon in the crypto space. In 2025, Bybit suffered roughly $1.5 billion in losses due to a hack. More recently, Bitget lost more than $350 million worth of digital assets in a cyber theft incident. Over the past several years, bad actors have also drained billions of dollars in crypto from decentralized exchanges.
This week’s breach “proves our exact point in proposing regulations for crypto markets earlier this month,” Michael Selig, chairman of the Commodity Futures Trading Commission, said Friday in a CNBC “Squawk on the Street” interview. The U.S. derivatives regulator on Oct. 5 proposed a framework that would effectively put crypto exchanges under federal government oversight — after Congress failed to approve legislation to regulate the asset.
“The real issue here is that these are unregulated offshore exchanges, and they don’t have the same sorts of safeguards that we have in our financial markets here in the United States. We want to offer a federal option to these exchanges to come and register with the CFTC, and they would be subject to the same sorts of cyber security safeguards that we have in our markets today,” he said.
Outside efforts
Circle CEO Jeremy Allaire said Thursday evening in a social media post that the company had frozen more than 800 million in USD Coin associated with the incident. USDT stablecoin issuer Tether CEO Paolo Ardoino also said in on X that his firm had frozen more than 1.5 billion of its stablecoin that may have been related to a potential breach.
Jack McDonald, Ripple’s senior vice president of stablecoins, said it was actively freezing affected funds held in RLUSD, its U.S. dollar-backed stablecoin.