The cryptocurrency world has been rocked by one of the largest security breaches in financial history. Binance, the world’s largest centralized cryptocurrency exchange, is currently investigating a multi-billion-dollar exploit involving an Ethereum-linked wallet system. Initial impact estimates place the total loss at approximately $6.3 billion, sending shockwaves across global digital asset markets, triggering widespread emergency responses from industry heavyweights, and prompting a severe market downturn.
What We Know About the Binance Hack
As the timeline of the incident unfolded, elite on-chain analysts, security firms, and blockchain investigators began piecing together how the sophisticated assault was executed. Chainalysis co-founder and CEO Jonathan Levin reported that the breach was likely carried out by the notorious North Korean hacking group known as TraderTraitor, drawing direct parallels to previous high-profile exploits.
In a post shared on X, Levin quantified the theft at approximately $6.4 billion, marginally higher than Binance’s internal estimate of $6.3 billion. He noted that swift coordination among industry partners had successfully frozen roughly $3 billion of the stolen capital, while Chainalysis teams continued tracking the remaining assets across various blockchain networks.
Independent on-chain investigator ZachXBT added further weight to the attribution, revealing that funds stolen from the Binance attack and an earlier exploit involving Bitget were commingled in the exact same wallet address after being routed via THORChain. According to ZachXBT, this overlap strongly indicates that the same bad actor orchestrated both incidents. Furthermore, the Bitget exploit had previously been tied to the Democratic People’s Republic of Korea (DPRK)-linked TraderTraitor collective, which shares infrastructure signatures with historical breaches such as the Kelp DAO incident.
Blockaid co-founder and CEO Ido Ben-Natan echoed these assessments in an interview with Cointelegraph, stating that the nature of the attack bore all the hallmarks of North Korean state-sponsored cyber operations. Ben-Natan pointed to sophisticated on-chain preparations, custom sweeper contracts, and complex multiple authorizations as clear indicators of advanced threat actors.
Independent security firm TRM Labs also attributed the attack to TraderTraitor with a high degree of confidence, citing robust on-chain and off-chain intelligence. The FBI has previously identified TraderTraitor as the primary group responsible for the staggering Bybit hack that occurred in February of the previous year.
Binance Expects Withdrawals to Resume Within 48 Hours
In response to the unprecedented breach, Binance moved swiftly to secure its systems. The exchange announced that withdrawals remain temporarily paused while engineering and security teams complete a comprehensive security revamp of its withdrawal service and associated infrastructure addresses. Binance stated that normal service is expected to resume within 48 hours, while emphasizing that user deposits continue to operate normally.
According to preliminary internal investigations, the security incident involved multiple vectors. Binance’s security team has been tracing the complete attack path back to a compromised computer belonging to a DevOps engineer, which investigators suspect served as the primary entry point for the malicious actors.
Binance Hack Could Accelerate Shift to DEXs: Standard Chartered
The fallout from the Binance breach could have long-lasting structural implications for the broader cryptocurrency ecosystem. According to Geoffrey Kendrick, global head of digital assets research at Standard Chartered, the incident may accelerate a structural migration of crypto trading activity toward decentralized exchanges (DEXs), providing a structural tailwind for protocols like Uniswap over the long term.
In a research note shared via email, Kendrick maintained his ambitious $100 price target for Uniswap’s UNI token by the year 2030, suggesting that the unprecedented breach of the world’s largest centralized exchange highlights systemic counterparty risks that could make his forecast conservative. Citing recent market data from CoinGecko, which showed the top 10 spot DEX-to-CEX trading volume ratio climbing to 23.5% in the second quarter, Kendrick encouraged investors to re-engage with decentralized infrastructure. He pointed out that established DEXs have historically avoided major structural exploits, meaning centralized exchange security failures will likely fuel continuous adoption of decentralized trading venues.
Binance Points to Engineer’s Hacked Laptop in Breach
Providing deeper technical context into the mechanics of the multi-billion-dollar breach, Binance confirmed that its preliminary investigation centers around a compromised laptop utilized by a DevOps engineer.
The exchange clarified that the unauthorized access to the employee’s machine potentially allowed the attacker to infiltrate an internal service container and submit unauthorized withdrawal transactions. Crucially, Binance reiterated that its ongoing investigation has found zero evidence of a wallet private-key leak, though exhaustive forensic reviews remain ongoing as the final accounting of the incident is finalized.
First Digital Confirms It Has Frozen FDUSD Involved in Attack
As stolen funds began moving through various channels, stablecoin issuers and cross-chain platforms moved rapidly to contain the damage. First Digital CEO Vincent Chok confirmed that the company successfully froze all holdings of its FDUSD stablecoin that were implicated in the attack.
In a written statement, Chok noted that First Digital is working hand-in-hand with the Binance team to monitor illicit movements and share actionable intelligence. He emphasized that the primary objective of the issuer is to protect token holders and prevent bad actors from liquidating or transferring compromised assets across the financial ecosystem.
Bitcoin Trades Below $77,000 as BNB Falls 8%
The macroeconomic and market impact of the hack was felt immediately across digital asset markets. According to CoinGecko data, Bitcoin tumbled nearly 4.9% over a 24-hour window, trading near $76,937. Binance’s native token, BNB, suffered an 8% drop to approximately $693, while Ether retreated 5.7% to hover near $2,211.
Decentralized finance (DeFi) tokens were hit even harder amid fears of systemic contagion. AAVE saw its token price plunge 11.3%, and Uniswap’s UNI declined 10.7% over the same period. Investor sentiment deteriorated sharply, with the Bitcoin Fear and Greed Index plunging into "fear" territory with a score of 30—a sentiment reading not observed since August.
Binance Says $3 Billion Frozen From Hack
Despite the massive scale of the initial breach, collaborative multi-party intervention successfully clawed back significant portions of the stolen capital. Binance updated its verified figures, announcing that total assets frozen across the industry had reached $3 billion.
The upward revision followed an emergency governance action by the Arbitrum Security Council, which executed an emergency transaction to freeze $30.5 million worth of assets tied to the exploit, including 74.6 million Arbitrum (ARB) tokens and 8,425 Ether (ETH). In an official statement, the council explained that the intervention was executed to safeguard the security and integrity of the Arbitrum governance ecosystem without adversely affecting everyday users or applications. The frozen tokens were successfully transferred to an intermediary frozen wallet, rendering them entirely inaccessible to the original holder unless released by subsequent Security Council actions or a formal Arbitrum DAO governance vote.
Chainalysis Estimates $5.9 Billion Stolen From Binance
While Binance confirmed its internal tracking, blockchain analytics firm Chainalysis issued an independent valuation, estimating that approximately $5.912 billion in digital assets was removed from the exchange at the time of the theft. This figure dwarfs historical industry exploits, representing nearly four times the scale of the crypto exchange Bybit hack that occurred the previous year.
Blockaid Suspects Binance Hack Involved Private Key “Misuse”
Offering technical analysis on how the exploit was executed without an overt private key leak, Blockaid co-founder and CEO Ido Ben-Natan explained that the incident likely involved transaction-signing manipulation.
Speaking to Cointelegraph, Ben-Natan noted that preliminary forensic assessments pointed toward infrastructure key misuse, wherein attackers manipulate or compromise a signing environment to trick authorization mechanisms into approving malicious transactions directly. Arkham CEO Miguel Morel added that on-chain monitoring indicated the movement of funds remained an active and ongoing situation.
Binance Says Deposits Temporarily Suspended
To reinforce perimeter security and assist law enforcement agencies, Binance confirmed a temporary suspension of both deposits and withdrawals across its core platforms, alongside a temporary halt to Binance Alpha trading operations.
The exchange issued a statement promising total transparency, noting that engineering teams are working around the clock to finalize containment procedures and will publish a comprehensive post-mortem report once investigations conclude. Crucially, Binance reiterated its commitment to covering all user losses resulting from the incident.
Wintermute and GSR Disclose Binance Exposure
Major institutional market makers Wintermute and GSR moved quickly to reassure investors regarding their institutional exposure to the exchange. As vital liquidity providers that quote buy and sell prices to facilitate deep order books, any severe disruption to their operations could ripple across the wider crypto economy.
GSR CEO Xin Song disclosed that his firm’s direct exposure to Binance accounted for less than 5% of its net equity, noting that GSR was in active dialogue with Binance to assist with recovery efforts. Similarly, Wintermute CEO Evgeny Gaevoy reported that his firm’s exposure remained under 20% of net equity, adding that he did not foresee any operational disruptions to their overarching trading businesses. Neither executive reported direct financial losses stemming from the exposure.
Ripple Freezes RLUSD Linked to Binance Hack
Ripple also joined the coordinated industry defense. Jack McDonald, senior vice president of stablecoins at Ripple, confirmed that the company was actively freezing holdings of its dollar-pegged RLUSD stablecoin linked to the Binance breach. Ripple teams are maintaining open lines of communication with investigators to trace and immobilize illicit capital.
Binance Says $2.54 Billion Frozen After Hack
Reconciling multiple public reports and estimates, Binance confirmed that verified asset freezes had initially surpassed $2.54 billion shortly after the discovery of the breach. The exchange emphasized that this figure was a living metric, expected to expand steadily as law enforcement agencies, token issuers, and blockchain forensics companies collaborate to track remaining fund flows.
World Liberty Financial Freezes $27 Million in USD1
Decentralized finance projects also mobilized their smart contract capabilities to block the movement of funds. World Liberty Financial froze $27 million worth of its US-dollar-pegged stablecoin USD1, alongside $2 million in WLFI tokens, according to Binance co-founder Yi He and World Liberty Financial CEO Zach Witkoff.
Working in close coordination with digital asset custodian BitGo, World Liberty Financial executed the freezes swiftly, emphasizing its full cooperation with ongoing criminal and forensic investigations to hold the perpetrators accountable.
Binance Investigates Multibillion-Dollar Security Breach
The crisis initially erupted late Thursday when suspicious transactions originating from an Ethereum hot wallet prompted immediate alerts across the blockchain analytics community. Blockchain researcher Spreek first highlighted unusual transfers moving from a Binance-associated wallet to freshly generated addresses via contract interactions funded by privacy protocol Tornado Cash. Subsequent tracking revealed that the compromised addresses had begun liquidating Tether (USDT) holdings via decentralized exchange liquidity pools.
Blockchain analytics provider Arkham Intelligence subsequently labeled a cluster of addresses as "binance-hacker-1029," tracking holdings that initially peaked near $5.84 billion. Binance co-founder Changpeng Zhao confirmed via social media that the anomalous activity constituted a coordinated hack, while expressing confidence that all affected user funds would be completely covered by the exchange’s reserves.
Tether, Circle Freeze Over $2.36 Billion
As the scale of the exploit became clear, stablecoin giants Tether and Circle executed emergency freezes to lock down billions of dollars in compromised tokens.
Circle CEO Jeremy Allaire confirmed that the company successfully froze over $800 million in USDC in direct coordination with law enforcement agencies. Moments later, Tether CEO Paolo Ardoino announced that Tether had frozen more than $1.567 billion in USDT linked to the incident, bringing the combined stablecoin freeze total to over $2.36 billion.
"Protecting the industry and our partners is our main priority," Ardoino stated.
The unfolding crisis at Binance coincided with temporary operational disruptions across other sectors of the crypto economy, including a brief trading halt at prediction market platform Polymarket following a third-party provider compromise that was subsequently resolved with user funds fully secured.
