Binance reports record $6.3 billion breach; nearly $3 billion frozen, withdrawals paused, bitcoin down 4%

How big it is

Chainalysis, the blockchain analysis firm, estimated that about 5.9 billion dollars was taken at the time of the theft, nearly four times the next-largest crypto theft, which was the roughly 1.5 billion dollars taken from the exchange Bybit in February 2025. The 6.3 billion dollar figure is Binance's estimate of the assets affected.

Tether, Circle, Ripple and World Liberty Financial together froze about 2.67 billion dollars of stablecoins, and the security council of the Arbitrum network froze about 30.5 million dollars. Binance.US, the exchange's separate American business, said it was not affected.

Blockchain analysis firm TRM Labs has set out a timeline. Preparation began at least 36 hours before the theft. At 20:20 UTC, the operator submitted one transaction containing 50 pre-signed authorisations from Binance's hot wallet, pointing to a contract that sweeps funds. About three minutes and 24 seconds later, the operator instructed the hot wallet to send its entire balance to an address controlled by the attacker, which moved 167,464 ether and 63 tokens, including 1.615 billion tethers. TRM attributes the attack, with high confidence, to North Korea's hacking group known as TraderTraitor, citing similarities to the Bybit theft and to an April 2026 attack on KelpDAO. It says that the laundering so far has relied on large swaps through market makers and lending protocols, unlike the heavy use of bridges after the Bybit theft. Binance has not itself named a culprit.

Binance said it will cover all losses from its emergency fund, called SAFU, and from its own funds. One analyst estimated the fund at about 1.2 billion dollars, which could cover roughly a third of the remaining losses if the frozen stablecoins are eventually returned. The reports do not describe the effect on individual customers beyond the pledge to cover losses. Users with money on the exchange should watch Binance's official announcements for the reopening of withdrawals, and should be careful of phishing messages that claim to offer refunds.

Bitcoin fell more than 4 per cent on Friday as the news weighed on the market. A large share of the frozen amount is in stablecoins, which the issuers can freeze, while assets such as bitcoin and ether cannot be frozen in the same way, which is why the issuers' action matters to the recovery.

The next steps are the reopening of withdrawals, a published explanation of the root cause, the tracing of the funds that are not frozen, and the response of regulators. In India, where crypto assets are taxed and widely traded on exchanges, the incident may draw attention to how such platforms are supervised.