Binance hack: what happened, and is your money safe now?

The Binance hack began with a single compromised work computer, according to the company’s own early findings. Co-CEO Richard Teng said the investigation so far suggests an attacker took over a laptop used by a DevOps engineer, the kind of staffer who keeps servers and software running. From there, the attacker reached a service container (a small, sealed-off piece of software running on Binance’s systems) and used it to submit withdrawal requests that nobody had approved.

Teng was careful to add two points. He said this was not a simple one-click raid using one person’s access, but a more complex chain of steps. And he said Binance has found no sign so far that any wallet private keys, the master passwords that control crypto holdings, were leaked. He also stressed that no individual employee has been blamed.

Crypto watchers on social media noticed unusual money movements and raised the alarm hours before Binance confirmed the problem. Once it did, the company said its estimate of the total impact was around $6.3 billion, with roughly $3 billion already frozen on the blockchain with the help of partners.

• Estimated impact: about $6.3 billion
• Frozen so far: about $3 billion
• Previous record: the $1.5 billion Bybit hack in 2025
• Not affected: Binance.US and Coinbase, both say

Two blockchain analysis firms, TRM Labs and Chainalysis, say they have high confidence the attack was the work of TraderTraitor, a state-backed North Korean hacking unit. Security company Check Point says the same group is also known as Lazarus Group, the name most people have heard. Analysts say several features of this attack echo the Bybit theft, which held the record until this week and was also blamed on North Korea.

Binance has not confirmed the North Korea link. It said it is working with law enforcement to identify the attackers. Western security agencies have said in the past that North Korea uses stolen crypto to help pay for its weapons programs, and the country has denied taking part in such hacks.

Check Point’s security chief, Jayant Dave, pointed to a worrying pattern: a September attack on another exchange, Bitget, worked in a similar way. His point is that attackers no longer need to steal the keys to the vault. They go after the people and systems that are allowed to use them. That shift matters for every exchange, not just Binance.

Binance’s answer is yes. Teng told customers their money is safe and that the company is covering every loss. The exchange says it will pay for the gap from its Secure Asset Fund for Users (SAFU), an emergency reserve held in bitcoin that exists for exactly this kind of breach, plus its own company funds. Founder Changpeng Zhao, who no longer runs the exchange, posted on X that as a shareholder he expects all user funds to be fully covered.

The size of the cushion is the key question. Binance has more than 300 million registered users and reported about $162.8 billion in customer assets in its 2025 annual report, so a $6.3 billion hole is large but not existential. Still, the company has not said exactly how much sits in the SAFU fund today, and about $3.3 billion was still unaccounted for when the freeze figures came out.

Here is the catch for customers: you cannot move your crypto off the exchange right now. Co-CEO Yi He said withdrawals will stay off until the systems are confirmed secure. Reports differ on deposits. One Binance statement said deposits and withdrawals were both suspended as a precaution, while a later update said deposits were working normally. Check the exchange’s own status page before you send anything in.

Stolen crypto is hard to hide when it sits in stablecoins, digital dollars whose issuers can lock specific wallets. That is what happened here. Tether, the biggest stablecoin issuer, said it froze roughly $1.5 billion tied to the attack, and Circle, which issues USDC, froze more than $800 million. World Liberty Financial, the crypto company linked to President Donald Trump’s family, said it also helped lock stolen funds with its custody partner.

Freezes buy time, but they don’t return money on their own. TRM Labs’ Ari Redbord said the attacker still holds a huge sum, so tracing and recovery are far from over. North Korean groups have a track record of moving coins quickly through mixers and other blockchains before anyone can step in.

The wider market felt it fast. Bitcoin slid more than 3% to a six-week low of $76,368 in early Asian trading on Friday. Shares of Coinbase fell 4.8% and Strategy, the company that buys bitcoin for its balance sheet, dropped nearly 6% in after-hours trading. Ethereum and Solana fell sharply too.

The bigger lesson is about where you keep your coins. When crypto sits on an exchange, the exchange holds the keys and you hold a promise. That works until something like this happens. Analysts expect more people to rethink the safety of large trading platforms, and some think smaller exchanges, which could never absorb a loss this big, will lose customers first. Big thefts were already common: attackers took $2.9 billion across nearly 150 attacks last year, TRM Labs says.

If you have crypto on Binance or anywhere else, a few steps make sense today:

1. Don’t panic-sell on a frozen platform. Binance says losses are covered, and trades placed in a rush often cost more than they save.
2. Watch for scams. Fake “Binance support” messages and refund links always follow big hacks. Binance will never ask for your password or recovery phrase.
3. Turn on strong account security everywhere you trade: an authenticator app or passkey, plus a withdrawal allowlist if your exchange offers one.
4. Consider self-custody for coins you plan to hold long term, such as a hardware wallet, once withdrawals reopen. Keep only what you trade on an exchange.