Topline

Cryptocurrency exchange Binance said Friday afternoon it will soon resume withdrawals on its platform, issuing an update after a “complex” hack resulted in the loss of $6.3 billion worth of token assets.

This was first published on Forbes.com

Key Facts

Binance said in the update it is planning to begin resuming withdrawal service “within approximately 34 hours, subject to the completion of security checks,” noting the service will resume in phases.

In a statement earlier Friday morning, the company said its preliminary investigation of the “security incident” suggested that a company software engineer’s laptop may have been compromised, allowing hackers to access its systems and initiate unauthorized withdrawals.

Binance estimated the incident’s total impact at around $6.3 billion, but said it worked with blockchain partners to freeze about $3 billion in affected assets.

The company also said it found no evidence that any wallet private keys were leaked and is working with law enforcement and blockchain investigators to identify the attackers and recover assets.

The crypto exchange said it would cover all losses using its Secure Asset Fund for Users (SAFU) and other company funds and insisted that “User funds are safe.”

Binance said it will publish an updated proof of reserves once it completes its remediation efforts.

The estimated $6.3 billion impact makes this the largest cryptocurrency theft on record, surpassing $1.5 billion stolen from crypto exchange Bybit in February 2025.

Binance Co-founder and Stablecoin chiefs comment on hack

Earlier Thursday evening, Changpeng Zhao, Binance co-founder, said in an X post, “It does look like a hack on Binance,” noting he no longer manages the company’s platform but, as a shareholder, “I expect all user funds will be fully recovered.” Paolo Ardoino, the CEO of the stablecoin Tether, said his company froze more than $1.56 billion “related to a potential Binance exchange hack.” Circle, which issues the USDC stablecoin that is pegged one to one to the U.S. dollar, froze more than 800 million USDC, according to Circle chief Jeremy Allaire.

Was North Korea Behind The Hack?

Blockchain intelligence firm TRM Labs published a report that linked the Binance breach to North Korea’s TraderTraitor hacking group with “high confidence,” citing analysis of blockchain transactions and other intelligence. The report said: “Several features of this attack match earlier North Korea-linked heists,” including the $1.5 billion Bybit hack. Like those earlier attacks, the Binance incident also involved extensive advance preparation and the use of Tornado Cash, a cryptocurrency mixing service designed to obscure the origins of funds. Another crypto intelligence firm, Pangolin Intelligence, also attributed the hack to TraderTraitor, The Wall Street Journal reported. Binance has not yet commented on the indentity of the hackers.

Crucial Quote

“Hot wallets getting drained is not something new to crypto, but the amount would be a meaningful hack on the largest crypto exchange,” Bloomberg Intelligence analyst James Seyffart told the news outlet Thursday. “It’s definitely a bad look. And this is one after another.”

Key Background

Binance was last hacked in 2022, when an attacker artificially minted two million BNB tokens worth about $570 million. However, Binance’s intervention reduced the amount the attacker was able to take to roughly $115 million. Fellow cryptocurrency exchange BitGet was hacked in September, losing about $388 million and freezing just $1.1 million of that amount. CEO Gracy Chen told CNBC she was “not expecting to recover a lot of funds.”

TANGENT

Another hack was also carried out Thursday against prediction market Polymarket, which halted trading on its international platform and said any users impacted by the attack “will be made whole.” The Block reported about $2.6 million in cryptocurrency was taken from Polymarket users’ wallets.