The breach is believed to have been carried out by a North‑Korean hacking unit known as TraderTraitor, according to blockchain‑analysis firms Elliptic, Chainalysis and TRM. The attackers moved the bulk of the funds across 10 blockchains in roughly 20 minutes, a speed and scale that has drawn comparisons to the $1.5 bn Bybit hack last year.
Binance, which has 335 million registered users and held $162.8 bn in assets under custody as of its 2025 report, said the initial entry point may have been a compromised laptop belonging to an engineer, but further investigations revealed additional points of breach. CEO Changpeng Zhao, who stepped down in 2023 after pleading guilty to money‑laundering violations, posted on X that “user funds are safe” and that the company would fully cover any losses.
Markets reacted swiftly: Bitcoin fell 5 % in early Asian trading, sliding to $77,380 – its lowest level in six weeks. Binance has temporarily suspended withdrawals while security teams trace and recover the remaining assets, working closely with law‑enforcement agencies worldwide, including the FBI and the U.S. Secret Service.
While Binance.US and other exchanges reported no impact, regulators in the UK are monitoring the situation for potential spill‑over effects on the wider financial system. The incident underscores the growing vulnerability of centralised crypto platforms to sophisticated state‑backed attacks.
