Binance freezes withdrawals after $6.3bn record crypto heist

Binance, the world’s largest cryptocurrency exchange, is dealing with what could be the biggest theft in crypto history, after hackers reportedly affected $6.3 billion worth of funds in a breach that forced the platform to suspend customer withdrawals.

The exchange said $3 billion of the affected funds had been frozen. It also assured customers that their money was safe and that it would bear any losses resulting from the attack.

Withdrawals were suspended on Friday as Binance began working with law enforcement agencies and reviewing its security systems. Co-founder Yi He said the exchange expected to restore withdrawals by Sunday.

The incident comes at a difficult time for the cryptocurrency industry, which has been working to attract more institutional investors and build confidence among mainstream users.

The estimated $6.3 billion affected is more than four times the value of the previous largest publicly reported exchange hack. In February 2025, attackers stole nearly $1.5 billion from Bybit.

Blockchain intelligence firm TRM Labs has linked the Binance attack to TraderTraitor, a hacking group associated with North Korea. The firm described it as the largest cryptocurrency theft on record, saying its conclusion was based on on-chain and off-chain intelligence.

According to TRM, the attackers appear to have gained access to Binance’s internal systems and exploited its transaction authorisation process to approve transfers across 10 blockchain networks, including Bitcoin and Ethereum.

Binance said a software engineer’s laptop may have been compromised during the attack. However, the exchange said it had found no evidence that private keys controlling its wallets were exposed.

The news quickly affected cryptocurrency prices. Bitcoin fell below $77,000, its lowest level in more than a month, before recovering some of its losses to trade around $78,400 during Asian trading on Friday.

The reaction reflects the importance of Binance to the wider market. A security failure at an exchange of its size can affect confidence in other platforms, particularly among investors already concerned about the safety of their digital assets.

Fredrick Collins, chief executive and co-founder of cryptocurrency data platform Velo Data, said concerns surrounding Binance were weighing on digital asset prices. He noted that the exchange’s position in the market meant that any loss of confidence in the platform could extend to the wider industry.

There have also been efforts to recover some of the affected funds. Tether chief executive Paolo Ardoino said the company had frozen more than $1.5 billion in its stablecoin linked to the potential Binance hack.

Circle Internet Group, which issues the USDC stablecoin, also confirmed that it had frozen about $800 million amid reports of the breach.

Binance could also rely on its Secure Asset Fund for Users (SAFU), an emergency reserve established in 2018 to protect customers in exceptional circumstances. The fund has generally been maintained at around $1 billion, although its value has changed over time with market movements.

The latest attack adds to a growing list of security breaches involving cryptocurrency companies. Bitget has suffered recent incidents involving stolen funds, while tampering linked to Ledger devices has also resulted in investor losses.

Polymarket, a cryptocurrency-based prediction platform, was also forced to halt trading on its international exchange for about an hour on Friday after a third-party software provider was compromised.

Blockchain analytics firm Bubblemaps said more than 700 Polymarket users lost about $2.7 million. A company spokesperson declined to comment on the figures.

The Binance breach has brought back concerns surrounding some of crypto’s biggest failures, including the collapse of FTX in November 2022 and the Mt. Gox exchange hack in Japan. The latter eventually led to the platform’s bankruptcy after years of losses linked to stolen Bitcoin.

For an industry trying to establish itself as part of the global financial system, repeated security incidents remain a concern for investors. The latest breach also raises questions about the safeguards exchanges have in place as increasingly large amounts of money move through digital asset platforms.

The problem is not limited to cryptocurrency businesses. South Korea’s Daishin Securities disclosed a data leak affecting about 38,000 customers this week, while Mirae Asset Global Investments also reported a hacking incident, according to Yonhap.

The incidents show that cyber risk is becoming a growing concern across financial services, from traditional securities firms to cryptocurrency exchanges, with customer funds and information increasingly exposed to attacks on digital infrastructure. (BusinessDay)