The world's largest cryptocurrency exchange, Binance, is grappling with a record-breaking heist valued at approximately $6.3 billion. Initial investigations by the company suggest that the security incident originated from a compromised laptop belonging to a DevOps engineer. This breach allegedly allowed an attacker to access a service container and submit unauthorized withdrawal transactions across multiple blockchain networks.
The stolen assets include significant amounts of Ethereum, Bitcoin, Solana, and XRP. In response, Binance has collaborated with blockchain partners to freeze roughly $3 billion worth of the stolen funds, leaving approximately $3.3 billion still unaccounted for. Despite the massive loss, Binance founder Changpeng Zhao took to social media platform X to assure users that all funds would be fully covered. Zhao, who previously served a four-month prison sentence for anti-money-laundering violations before being pardoned by President Donald Trump, is no longer running the exchange but confirmed the company's commitment to covering the losses.
Security experts have analyzed the mechanics of the attack, noting that the perpetrators did not break encryption or steal private keys directly. Instead, Jayant Dave from Check Point explained to BBC News that the attackers took over the system responsible for instructing keys on what to sign. Emily Taylor, co-founder of the Global Signal Exchange, described the operation as being conducted on a speed and scale never before seen.
Blockchain intelligence firm TRM suggests the theft involved the misuse of a hot wallet, which is connected to the internet to process customer withdrawals. While early reports indicated phishing of authorizations for an Ethereum hot wallet, subsequent thefts from wallets on different chains with varying signing schemes imply deeper system access. TRM stated that the most likely scenario is that the attacker gained the ability to force Binance's hot wallet signing system to sign transactions of their choosing across ten different chains within hours.
Regarding the identity of the perpetrators, TRM points to TraderTraitor, a state-sponsored North Korean hacking group previously linked to a $1.5 billion hack of Bybit in February 2025. Binance has stated it is working with law enforcement to confirm the hackers' identities but has not yet issued an official attribution. The incident raises significant questions about how a single compromised device could authorize billions in transactions and challenges perceptions regarding the decentralization and security of the cryptocurrency market.
Sources: PC Gamer.