Binance Hack Estimated $6.3B Affected; SAFU to Cover

Binance investigates major security breach affecting $6.3B

Binance, the world’s largest cryptocurrency exchange, announced it is probing a significant security incident that it currently estimates has impacted roughly $6.3 billion in digital assets. The exchange says the attacker likely gained access after compromising a DevOps engineer’s laptop, which allowed unauthorized withdrawal transactions via a service container in the firm’s infrastructure. Binance has paused deposits and withdrawals while the forensic investigation continues.

Immediate response: on-chain freezes and SAFU reimbursement

According to the company, approximately $3 billion of the assets tied to the incident have already been frozen on-chain in cooperation with blockchain partners. Binance reaffirmed that user funds remain protected and stated it will fully compensate any customer losses from its SAFU emergency fund and corporate resources. The exchange also emphasized that there is, as yet, no evidence that its custodial private keys were disclosed. A detailed technical report will be published once the investigation is complete.

It is important to note that freezing or blocking crypto on-chain does not automatically return funds to original owners. Asset freezes prevent movement but restoring funds to rightful holders typically requires additional legal steps, coordinated recovery, or law enforcement action.

How the attacker gained access

Preliminary Binance findings indicate the breach may have begun with the compromise of a DevOps engineer’s laptop. From there, the attacker reportedly accessed a service container and executed unauthorized withdrawal transactions. Binance has not released full technical details of the intrusion; the exchange says it will disclose the final findings only after verification of all evidence and completion of the security review.

On-chain analysis points to suspected North Korean hacker group

Blockchain intelligence firm TRM Labs has attributed the incident with high confidence to the TraderTraitor group, which US authorities associate with North Korean state-backed hacking operations. TRM’s on-chain and off-chain analysis found behavioral similarities between this incident and previous attacks attributed to North Korean actors, including long-term planning and pre-compromise preparation to obtain transaction signatures ahead of the theft.

TRM estimates that about $6.36 billion in digital assets were moved out of Binance wallets across 10 different blockchain networks, with the bulk of transfers occurring within an approximately 20-minute window. This rapid, multi-chain exfiltration is consistent with sophisticated crypto theft campaigns and underscores challenges in cross-chain tracking and rapid response.

Regulatory and market implications

Despite the large estimated loss, most analysts do not see the incident as an immediate solvency threat to Binance. The exchange’s pledge to cover losses from SAFU and corporate funds aims to reassure customers and markets. Still, the event raises renewed concerns about cryptocurrency exchange security, operational risk, and the role of custodial custody models versus self-custody in protecting digital assets.

Law enforcement agencies and industry partners are engaged in tracing the funds and attempting to disrupt money-laundering paths. The FBI previously linked TraderTraitor to a $1.5 billion attack on another exchange, Bybit, in February 2025. This context adds weight to TRM Labs’ attribution and highlights the persistent threat from state-affiliated hacking groups targeting centralized exchanges.

What users should do now

Users should monitor official Binance communications and avoid sharing credentials or recovery phrases. Exchanges and custodians should review DevOps security, endpoint protections, and container hardening. For the broader crypto community, this incident is a reminder to evaluate risk, consider hardware wallets and self-custody for long-term holdings, and follow best practices for private key management and multi-signature solutions.

Binance has promised a comprehensive technical disclosure once the investigation concludes. In the meantime, on-chain investigators, blockchain analytics firms, and regulators will continue tracing the stolen funds and assessing legal remedies for asset recovery.